• Xin Long's avatar
    ipv6: fix calling in6_ifa_hold incorrectly for dad work · bedc836a
    Xin Long authored
    [ Upstream commit f8a894b2 ]
    
    Now when starting the dad work in addrconf_mod_dad_work, if the dad work
    is idle and queued, it needs to hold ifa.
    
    The problem is there's one gap in [1], during which if the pending dad work
    is removed elsewhere. It will miss to hold ifa, but the dad word is still
    idea and queue.
    
            if (!delayed_work_pending(&ifp->dad_work))
                    in6_ifa_hold(ifp);
                        <--------------[1]
            mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
    
    An use-after-free issue can be caused by this.
    
    Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in
    net6_ifa_finish_destroy was hit because of it.
    
    As Hannes' suggestion, this patch is to fix it by holding ifa first in
    addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if
    the dad_work is already in queue.
    
    Note that this patch did not choose to fix it with:
    
      if (!mod_delayed_work(delay))
              in6_ifa_hold(ifp);
    
    As with it, when delay == 0, dad_work would be scheduled immediately, all
    addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.
    Reported-by: default avatarWei Chen <weichen@redhat.com>
    Suggested-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
    Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    bedc836a
addrconf.c 141 KB