Patch "ipv6: addrconf: fix dev refcont leak when DAD failed" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

ipv6: addrconf: fix dev refcont leak when DAD failed

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv6-addrconf-fix-dev-refcont-leak-when-dad-failed.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Wei Yongjun <[email protected]>
Date: Mon, 5 Sep 2016 16:06:31 +0800
Subject: ipv6: addrconf: fix dev refcont leak when DAD failed

From: Wei Yongjun <[email protected]>

commit 751eb6b6042a596b0080967c1a529a9fe98dac1d upstream.

In general, when DAD detected IPv6 duplicate address, ifp->state will be set to INET6_IFADDR_STATE_ERRDAD and DAD is stopped by a delayed work, the call tree should be like this:

ndisc_recv_ns
-> addrconf_dad_failure <- missing ifp put

     -> addrconf_mod_dad_work
       -> schedule addrconf_dad_work()
         -> addrconf_dad_stop()  <- missing ifp hold before call it

addrconf_dad_failure() called with ifp refcont holding but not put. addrconf_dad_work() call addrconf_dad_stop() without extra holding refcount. This will not cause any issue normally.

But the race between addrconf_dad_failure() and addrconf_dad_work() may cause ifp refcount leak and netdevice can not be unregister, dmesg show the following messages:

IPv6: eth0: IPv6 duplicate address fe80::XX:XXXX:XXXX:XX detected!
...
unregister_netdevice: waiting for eth0 to become free. Usage count = 1

to workqueue")

---
 net/ipv6/addrconf.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -1898,6 +1898,7 @@ errdad:
 	spin_unlock_bh(&ifp->lock);
 
 	addrconf_mod_dad_work(ifp, 0);
+	in6_ifa_put(ifp);
 }
 
 /* Join to solicited addr multicast group.

@@ -3609,6 +3610,7 @@ static void addrconf_dad_work(struct wor
 		addrconf_dad_begin(ifp);
 		goto out;
 	} else if (action == DAD_ABORT) {
+		in6_ifa_hold(ifp);
 		addrconf_dad_stop(ifp, 1);
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ipv6-addrconf-fix-dev-refcont-leak-when-dad-failed.patch