netdev - Re: [PATCH] ipv6: Fix idev->addr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170412.132412.327029350217921162.davem@davemloft.net>
Date:   Wed, 12 Apr 2017 13:24:12 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     rabin.vincent@...s.com
Cc:     netdev@...r.kernel.org, dsa@...ulusnetworks.com, rabinv@...s.com
Subject: Re: [PATCH] ipv6: Fix idev->addr_list corruption

From: Rabin Vincent <rabin.vincent@...s.com>
Date: Mon, 10 Apr 2017 08:36:39 +0200

> From: Rabin Vincent <rabinv@...s.com>
> 
> addrconf_ifdown() removes elements from the idev->addr_list without
> holding the idev->lock.
> 
> If this happens while the loop in __ipv6_dev_get_saddr() is handling the
> same element, that function ends up in an infinite loop:
> 
>   NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
>   Call Trace:
>    ipv6_get_saddr_eval+0x13c/0x3a0
>    __ipv6_dev_get_saddr+0xe4/0x1f0
>    ipv6_dev_get_saddr+0x1b4/0x204
>    ip6_dst_lookup_tail+0xcc/0x27c
>    ip6_dst_lookup_flow+0x38/0x80
>    udpv6_sendmsg+0x708/0xba8
>    sock_sendmsg+0x18/0x30
>    SyS_sendto+0xb8/0xf8
>    syscall_common+0x34/0x58
> 
> Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
> Signed-off-by: Rabin Vincent <rabinv@...s.com>

Applied and queued up for -stable, thank you.