• Wei Yongjun's avatar
    ipv6: addrconf: fix dev refcont leak when DAD failed · 81e6db1b
    Wei Yongjun authored
    [ Upstream commit 751eb6b6 ]
    
    In general, when DAD detected IPv6 duplicate address, ifp->state
    will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a
    delayed work, the call tree should be like this:
    
    ndisc_recv_ns
      -> addrconf_dad_failure        <- missing ifp put
         -> addrconf_mod_dad_work
           -> schedule addrconf_dad_work()
             -> addrconf_dad_stop()  <- missing ifp hold before call it
    
    addrconf_dad_failure() called with ifp refcont holding but not put.
    addrconf_dad_work() call addrconf_dad_stop() without extra holding
    refcount. This will not cause any issue normally.
    
    But the race between addrconf_dad_failure() and addrconf_dad_work()
    may cause ifp refcount leak and netdevice can not be unregister,
    dmesg show the following messages:
    
    IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
    ...
    unregister_netdevice: waiting for eth0 to become free. Usage count = 1
    
    Cc: stable@vger.kernel.org
    Fixes: c15b1cca ("ipv6: move DAD and addrconf_verify processing
    to workqueue")
    Signed-off-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    81e6db1b
addrconf.c 141 KB