netdev - Re: [PATCH net v2] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 10 Apr 2024 00:30:30 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Jiri Benc <jbenc@...hat.com>
Cc: netdev@...r.kernel.org, stephen@...workplumber.org, dsahern@...nel.org,
 edumazet@...gle.com
Subject: Re: [PATCH net v2] ipv6: fix race condition between ipv6_get_ifaddr and
 ipv6_del_addr

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@...nel.org>:

On Mon,  8 Apr 2024 16:18:21 +0200 you wrote:
> Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it
> still means hlist_for_each_entry_rcu can return an item that got removed
> from the list. The memory itself of such item is not freed thanks to RCU
> but nothing guarantees the actual content of the memory is sane.
> 
> In particular, the reference count can be zero. This can happen if
> ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry
> from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all
> references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough
> timing, this can happen:
> 
> [...]

Here is the summary with links:
  - [net,v2] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    https://git.kernel.org/netdev/net/c/7633c4da919a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html