|
 |
b37f23 |
centosplus patch [bug#12711]
|
|
|
b37f23 |
|
|
|
b37f23 |
commit 751eb6b6042a596b0080967c1a529a9fe98dac1d
|
|
|
b37f23 |
Author: Wei Yongjun <weiyongjun1@huawei.com>
|
|
|
b37f23 |
Date: Mon Sep 5 16:06:31 2016 +0800
|
|
|
b37f23 |
|
|
|
b37f23 |
ipv6: addrconf: fix dev refcont leak when DAD failed
|
|
|
b37f23 |
|
|
|
b37f23 |
In general, when DAD detected IPv6 duplicate address, ifp->state
|
|
|
b37f23 |
will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a
|
|
|
b37f23 |
delayed work, the call tree should be like this:
|
|
|
b37f23 |
|
|
|
b37f23 |
ndisc_recv_ns
|
|
|
b37f23 |
-> addrconf_dad_failure <- missing ifp put
|
|
|
b37f23 |
-> addrconf_mod_dad_work
|
|
|
b37f23 |
-> schedule addrconf_dad_work()
|
|
|
b37f23 |
-> addrconf_dad_stop() <- missing ifp hold before call it
|
|
|
b37f23 |
|
|
|
b37f23 |
addrconf_dad_failure() called with ifp refcont holding but not put.
|
|
|
b37f23 |
addrconf_dad_work() call addrconf_dad_stop() without extra holding
|
|
|
b37f23 |
refcount. This will not cause any issue normally.
|
|
|
b37f23 |
|
|
|
b37f23 |
But the race between addrconf_dad_failure() and addrconf_dad_work()
|
|
|
b37f23 |
may cause ifp refcount leak and netdevice can not be unregister,
|
|
|
b37f23 |
dmesg show the following messages:
|
|
|
b37f23 |
|
|
|
b37f23 |
IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
|
|
|
b37f23 |
...
|
|
|
b37f23 |
unregister_netdevice: waiting for eth0 to become free. Usage count = 1
|
|
|
b37f23 |
|
|
|
b37f23 |
Cc: stable@vger.kernel.org
|
|
|
b37f23 |
Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing
|
|
|
b37f23 |
to workqueue")
|
|
|
b37f23 |
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
|
|
|
b37f23 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
b37f23 |
|
|
|
b37f23 |
Submitted-by: alfredo
|
|
|
b37f23 |
Applied-by: Akemi Yagi <toracat@centos.org>
|
|
|
b37f23 |
|
|
|
b37f23 |
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
|
|
|
b37f23 |
index b7d5ce6..dc65579 100644
|
|
|
b37f23 |
--- a/net/ipv6/addrconf.c
|
|
|
b37f23 |
+++ b/net/ipv6/addrconf.c
|
|
|
b37f23 |
@@ -1656,6 +1656,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
|
|
|
b37f23 |
spin_unlock_bh(&ifp->state_lock);
|
|
|
b37f23 |
|
|
|
b37f23 |
addrconf_mod_dad_work(ifp, 0);
|
|
|
b37f23 |
+ in6_ifa_put(ifp);
|
|
|
b37f23 |
}
|
|
|
b37f23 |
|
|
|
b37f23 |
/* Join to solicited addr multicast group.
|
|
|
b37f23 |
@@ -3300,6 +3301,7 @@ static void addrconf_dad_work(struct work_struct *w)
|
|
|
b37f23 |
addrconf_dad_begin(ifp);
|
|
|
b37f23 |
goto out;
|
|
|
b37f23 |
} else if (action == DAD_ABORT) {
|
|
|
b37f23 |
+ in6_ifa_hold(ifp);
|
|
|
b37f23 |
addrconf_dad_stop(ifp, 1);
|
|
|
b37f23 |
goto out;
|
|
|
b37f23 |
}
|