netdev - Re: [PATCH net] ipv6: Handle missing host route in __ipv6_ifa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Oct 2019 11:12:10 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David Ahern <dsahern@...nel.org>, davem@...emloft.net,
        jakub.kicinski@...ronome.com
Cc:     netdev@...r.kernel.org, rajendra.dendukuri@...adcom.com,
        eric.dumazet@...il.com, David Ahern <dsahern@...il.com>
Subject: Re: [PATCH net] ipv6: Handle missing host route in __ipv6_ifa_notify



On 10/4/19 8:03 AM, David Ahern wrote:
> From: David Ahern <dsahern@...il.com>
> 
> Rajendra reported a kernel panic when a link was taken down:
> 
>


> up. There is a race between addrcond_dad_work getting scheduled and
> taking the rtnl lock and a process taking the link down (under rtnl).
> The latter removes the host route from the inet6_addr as part of
> addrconf_ifdown which is run for NETDEV_DOWN. The former attempts
> to use the host route in __ipv6_ifa_notify. If the down event removes
> the host route due to the race to the rtnl, then the BUG listed above
> occurs.
> 
> Since the DAD sequence can not be aborted, add a check for the missing
> host route in __ipv6_ifa_notify. The only way this should happen is due
> to the previously mentioned race. The host route is created when the
> address is added to an interface; it is only removed on a down event
> where the address is kept. Add a warning if the host route is missing
> AND the device is up; this is a situation that should never happen.
> 
> Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional")
> Reported-by: Rajendra Dendukuri <rajendra.dendukuri@...adcom.com>
> Signed-off-by: David Ahern <dsahern@...il.com>
> ---
>  net/ipv6/addrconf.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
>

This seems goot to me, thanks.

Reviewed-by: Eric Dumazet <edumazet@...gle.com>