From: Xin Long <lucien....@gmail.com> Date: Thu, 15 Jun 2017 16:33:58 +0800
> Now when starting the dad work in addrconf_mod_dad_work, if the dad work > is idle and queued, it needs to hold ifa. > > The problem is there's one gap in [1], during which if the pending dad work > is removed elsewhere. It will miss to hold ifa, but the dad word is still > idea and queue. > > if (!delayed_work_pending(&ifp->dad_work)) > in6_ifa_hold(ifp); > <--------------[1] > mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); > > An use-after-free issue can be caused by this. > > Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in > net6_ifa_finish_destroy was hit because of it. > > As Hannes' suggestion, this patch is to fix it by holding ifa first in > addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if > the dad_work is already in queue. > > Note that this patch did not choose to fix it with: > > if (!mod_delayed_work(delay)) > in6_ifa_hold(ifp); > > As with it, when delay == 0, dad_work would be scheduled immediately, all > addrconf_mod_dad_work(0) callings had to be moved under ifp->lock. > > Reported-by: Wei Chen <weic...@redhat.com> > Suggested-by: Hannes Frederic Sowa <han...@stressinduktion.org> > Acked-by: Hannes Frederic Sowa <han...@stressinduktion.org> > Signed-off-by: Xin Long <lucien....@gmail.com> Applied and queued up for -stable, thank you.
