lkml.org 
[lkml]   [2016]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 255/346] ipv6: addrconf: fix dev refcont leak when DAD failed
    3.16.39-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wei Yongjun <weiyongjun1@huawei.com>

    commit 751eb6b6042a596b0080967c1a529a9fe98dac1d upstream.

    In general, when DAD detected IPv6 duplicate address, ifp->state
    will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a
    delayed work, the call tree should be like this:

    ndisc_recv_ns
    -> addrconf_dad_failure <- missing ifp put
    -> addrconf_mod_dad_work
    -> schedule addrconf_dad_work()
    -> addrconf_dad_stop() <- missing ifp hold before call it

    addrconf_dad_failure() called with ifp refcont holding but not put.
    addrconf_dad_work() call addrconf_dad_stop() without extra holding
    refcount. This will not cause any issue normally.

    But the race between addrconf_dad_failure() and addrconf_dad_work()
    may cause ifp refcount leak and netdevice can not be unregister,
    dmesg show the following messages:

    IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
    ...
    unregister_netdevice: waiting for eth0 to become free. Usage count = 1

    Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing
    to workqueue")
    Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/ipv6/addrconf.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/net/ipv6/addrconf.c
    +++ b/net/ipv6/addrconf.c
    @@ -1686,6 +1686,7 @@ void addrconf_dad_failure(struct inet6_i
    spin_unlock_bh(&ifp->state_lock);

    addrconf_mod_dad_work(ifp, 0);
    + in6_ifa_put(ifp);
    }

    /* Join to solicited addr multicast group.
    @@ -3262,6 +3263,7 @@ static void addrconf_dad_work(struct wor
    addrconf_dad_begin(ifp);
    goto out;
    } else if (action == DAD_ABORT) {
    + in6_ifa_hold(ifp);
    addrconf_dad_stop(ifp, 1);
    goto out;
    }
    \
     
     \ /
      Last update: 2016-11-14 04:20    [W:4.151 / U:0.324 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site