netdev - Re: [PATCH net] ipv6/addrconf: fix a potential refcount underflow for idev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 8 Jul 2023 11:31:25 +0800
From: "Ziyang Xuan (William)" <william.xuanziyang@...wei.com>
To: Eric Dumazet <edumazet@...gle.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <netdev@...r.kernel.org>, <hannes@...essinduktion.org>,
	<fbl@...hat.com>
Subject: Re: [PATCH net] ipv6/addrconf: fix a potential refcount underflow for
 idev

> On Fri, Jul 7, 2023 at 12:17 PM Ziyang Xuan
> <william.xuanziyang@...wei.com> wrote:
>>
>> Now in addrconf_mod_rs_timer(), reference idev depends on whether
>> rs_timer is not pending. Then modify rs_timer timeout.
>>
>> There is a time gap in [1], during which if the pending rs_timer
>> becomes not pending. It will miss to hold idev, but the rs_timer
>> is activated. Thus rs_timer callback function addrconf_rs_timer()
>> will be executed and put idev later without holding idev. A refcount
>> underflow issue for idev can be caused by this.
>>
>>         if (!timer_pending(&idev->rs_timer))
>>                 in6_dev_hold(idev);
>>                   <--------------[1]
>>         mod_timer(&idev->rs_timer, jiffies + when);
>>
>> Hold idev anyway firstly. Then call mod_timer() for rs_timer, put
>> idev if mod_timer() return 1. This modification takes into account
>> the case where "when" is 0.
>>
>> Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
>> Signed-off-by: Ziyang Xuan <william.xuanziyang@...wei.com>
>> ---
>>  net/ipv6/addrconf.c | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
>> index 5479da08ef40..d36e6c5e3081 100644
>> --- a/net/ipv6/addrconf.c
>> +++ b/net/ipv6/addrconf.c
>> @@ -318,9 +318,9 @@ static void addrconf_del_dad_work(struct inet6_ifaddr *ifp)
>>  static void addrconf_mod_rs_timer(struct inet6_dev *idev,
>>                                   unsigned long when)
>>  {
>> -       if (!timer_pending(&idev->rs_timer))
>> -               in6_dev_hold(idev);
>> -       mod_timer(&idev->rs_timer, jiffies + when);
>> +       in6_dev_hold(idev);
>> +       if (mod_timer(&idev->rs_timer, jiffies + when))
>> +               in6_dev_put(idev);
>>  }
>>
> 
> 
> All callers own an implicit or explicit reference to idev, so you can
> use the traditional

Yes, thank you for your comment.

Thanks,
William Xuan

> 
> if (!mod_timer(&idev->rs_timer, jiffies + when))
>      in6_dev_hold(idev);
> .
>