Commit 751eb6b6 authored by Wei Yongjun's avatar Wei Yongjun Committed by David S. Miller

ipv6: addrconf: fix dev refcont leak when DAD failed

In general, when DAD detected IPv6 duplicate address, ifp->state
will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a
delayed work, the call tree should be like this:

ndisc_recv_ns
  -> addrconf_dad_failure        <- missing ifp put
     -> addrconf_mod_dad_work
       -> schedule addrconf_dad_work()
         -> addrconf_dad_stop()  <- missing ifp hold before call it

addrconf_dad_failure() called with ifp refcont holding but not put.
addrconf_dad_work() call addrconf_dad_stop() without extra holding
refcount. This will not cause any issue normally.

But the race between addrconf_dad_failure() and addrconf_dad_work()
may cause ifp refcount leak and netdevice can not be unregister,
dmesg show the following messages:

IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
...
unregister_netdevice: waiting for eth0 to become free. Usage count = 1

Cc: stable@vger.kernel.org
Fixes: c15b1cca ("ipv6: move DAD and addrconf_verify processing
to workqueue")
Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9d13744b
...@@ -1948,6 +1948,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp) ...@@ -1948,6 +1948,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
spin_unlock_bh(&ifp->lock); spin_unlock_bh(&ifp->lock);
addrconf_mod_dad_work(ifp, 0); addrconf_mod_dad_work(ifp, 0);
in6_ifa_put(ifp);
} }
/* Join to solicited addr multicast group. /* Join to solicited addr multicast group.
...@@ -3857,6 +3858,7 @@ static void addrconf_dad_work(struct work_struct *w) ...@@ -3857,6 +3858,7 @@ static void addrconf_dad_work(struct work_struct *w)
addrconf_dad_begin(ifp); addrconf_dad_begin(ifp);
goto out; goto out;
} else if (action == DAD_ABORT) { } else if (action == DAD_ABORT) {
in6_ifa_hold(ifp);
addrconf_dad_stop(ifp, 1); addrconf_dad_stop(ifp, 1);
if (disable_ipv6) if (disable_ipv6)
addrconf_ifdown(idev->dev, 0); addrconf_ifdown(idev->dev, 0);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment