liuyingdong / rpms / kernel

Forked from rpms/kernel 4 years ago
Clone
24d93b
centosplus patch [bug#12711]
24d93b
24d93b
commit 751eb6b6042a596b0080967c1a529a9fe98dac1d
24d93b
Author: Wei Yongjun <weiyongjun1@huawei.com>
24d93b
Date:   Mon Sep 5 16:06:31 2016 +0800
24d93b
24d93b
    ipv6: addrconf: fix dev refcont leak when DAD failed
24d93b
                                                        
24d93b
    In general, when DAD detected IPv6 duplicate address, ifp->state
24d93b
    will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a
24d93b
    delayed work, the call tree should be like this:
24d93b
                                                                    
24d93b
    ndisc_recv_ns                                                   
24d93b
      -> addrconf_dad_failure        <- missing ifp put             
24d93b
         -> addrconf_mod_dad_work                                   
24d93b
           -> schedule addrconf_dad_work()                          
24d93b
             -> addrconf_dad_stop()  <- missing ifp hold before call it
24d93b
                                                                       
24d93b
    addrconf_dad_failure() called with ifp refcont holding but not put.
24d93b
    addrconf_dad_work() call addrconf_dad_stop() without extra holding 
24d93b
    refcount. This will not cause any issue normally.                  
24d93b
                                                                       
24d93b
    But the race between addrconf_dad_failure() and addrconf_dad_work()
24d93b
    may cause ifp refcount leak and netdevice can not be unregister,   
24d93b
    dmesg show the following messages:                                 
24d93b
                                                                       
24d93b
    IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
24d93b
    ...
24d93b
    unregister_netdevice: waiting for eth0 to become free. Usage count = 1
24d93b
24d93b
    Cc: stable@vger.kernel.org
24d93b
    Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing
24d93b
    to workqueue")
24d93b
    Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
24d93b
    Signed-off-by: David S. Miller <davem@davemloft.net>
24d93b
24d93b
    Submitted-by: alfredo
24d93b
    Applied-by: Akemi Yagi <toracat@centos.org>
24d93b
24d93b
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
24d93b
index b7d5ce6..dc65579 100644
24d93b
--- a/net/ipv6/addrconf.c
24d93b
+++ b/net/ipv6/addrconf.c
24d93b
@@ -1656,6 +1656,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
24d93b
 	spin_unlock_bh(&ifp->state_lock);
24d93b
 
24d93b
 	addrconf_mod_dad_work(ifp, 0);
24d93b
+    in6_ifa_put(ifp);
24d93b
 }
24d93b
 
24d93b
 /* Join to solicited addr multicast group.
24d93b
@@ -3300,6 +3301,7 @@ static void addrconf_dad_work(struct work_struct *w)
24d93b
 		addrconf_dad_begin(ifp);
24d93b
 		goto out;
24d93b
 	} else if (action == DAD_ABORT) {
24d93b
+        in6_ifa_hold(ifp);
24d93b
 		addrconf_dad_stop(ifp, 1);
24d93b
 		goto out;
24d93b
 	}