netdev - Re: [PATCH net v2] ipv6/addrconf: fix a potential refcount underflow for idev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJ1fA4JbRwL4p7+puKrwO-wvj=TZbE_eC5NAVUZjG+xwA@mail.gmail.com>
Date: Sat, 8 Jul 2023 10:05:53 +0200
From: Eric Dumazet <edumazet@...gle.com>
To: Ziyang Xuan <william.xuanziyang@...wei.com>
Cc: davem@...emloft.net, dsahern@...nel.org, kuba@...nel.org, 
	pabeni@...hat.com, netdev@...r.kernel.org, hannes@...essinduktion.org, 
	fbl@...hat.com
Subject: Re: [PATCH net v2] ipv6/addrconf: fix a potential refcount underflow
 for idev

On Sat, Jul 8, 2023 at 8:59 AM Ziyang Xuan
<william.xuanziyang@...wei.com> wrote:
>
> Now in addrconf_mod_rs_timer(), reference idev depends on whether
> rs_timer is not pending. Then modify rs_timer timeout.
>
> There is a time gap in [1], during which if the pending rs_timer
> becomes not pending. It will miss to hold idev, but the rs_timer
> is activated. Thus rs_timer callback function addrconf_rs_timer()
> will be executed and put idev later without holding idev. A refcount
> underflow issue for idev can be caused by this.
>
>         if (!timer_pending(&idev->rs_timer))
>                 in6_dev_hold(idev);
>                   <--------------[1]
>         mod_timer(&idev->rs_timer, jiffies + when);
>
> To fix the issue, hold idev if mod_timer() return 0.
>
> Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer")
> Suggested-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: Ziyang Xuan <william.xuanziyang@...wei.com>

Reviewed-by: Eric Dumazet <edumazet@...gle.com>

Thanks !