Patch "ipv6: fix calling in6_ifa_hold incorrectly for dad work" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

ipv6: fix calling in6_ifa_hold incorrectly for dad work

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Xin Long <[email protected]>
Date: Thu, 15 Jun 2017 16:33:58 +0800
Subject: ipv6: fix calling in6_ifa_hold incorrectly for dad work

From: Xin Long <[email protected]>

[ Upstream commit f8a894b218138888542a5058d0e902378fd0d4ec ]

Now when starting the dad work in addrconf_mod_dad_work, if the dad work is idle and queued, it needs to hold ifa.

The problem is there's one gap in [1], during which if the pending dad work is removed elsewhere. It will miss to hold ifa, but the dad word is still idea and queue.

        if (!delayed_work_pending(&ifp->dad_work))
                in6_ifa_hold(ifp);
                    <--------------[1]
        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);

An use-after-free issue can be caused by this.

Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in net6_ifa_finish_destroy was hit because of it.

As Hannes' suggestion, this patch is to fix it by holding ifa first in addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if the dad_work is already in queue.

Note that this patch did not choose to fix it with:

  if (!mod_delayed_work(delay))
          in6_ifa_hold(ifp);

As with it, when delay == 0, dad_work would be scheduled immediately, all addrconf_mod_dad_work(0) callings had to be moved under ifp->lock.

---
 net/ipv6/addrconf.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -315,9 +315,9 @@ static void addrconf_mod_rs_timer(struct
 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
 				   unsigned long delay)
 {
-	if (!delayed_work_pending(&ifp->dad_work))
-		in6_ifa_hold(ifp);
-	mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+	in6_ifa_hold(ifp);
+	if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
+		in6_ifa_put(ifp);
 }
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/ipv6-fix-calling-in6_ifa_hold-incorrectly-for-dad-work.patch queue-4.9/igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch queue-4.9/sctp-return-next-obj-by-passing-pos-1-into-sctp_transport_get_idx.patch queue-4.9/sctp-disable-bh-in-sctp_for_each_endpoint.patch