Patch "ipv6: avoid unregistering inet6_dev for loopback" has been added to the 3.18-stable tree

This is a note to let you know that I've just added the patch titled

ipv6: avoid unregistering inet6_dev for loopback

to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv6-avoid-unregistering-inet6_dev-for-loopback.patch
and it can be found in the queue-3.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: WANG Cong <[email protected]>
Date: Wed, 21 Jun 2017 14:34:58 -0700
Subject: ipv6: avoid unregistering inet6_dev for loopback

From: WANG Cong <[email protected]>

commit 60abc0be96e00ca71bac083215ac91ad2e575096 upstream.

The per netns loopback_dev->ip6_ptr is unregistered and set to NULL when its mtu is set to smaller than IPV6_MIN_MTU, this leads to that we could set rt->rt6i_idev NULL after a rt6_uncached_list_flush_dev() and then crash after another call.

In this case we should just bring its inet6_dev down, rather than unregistering it, at least prior to commit 176c39af29bc ("netns: fix addrconf_ifdown kernel panic") we always override the case for loopback.

Thanks a lot to Andrey for finding a reliable reproducer.

---
 net/ipv6/addrconf.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -2829,6 +2829,7 @@ static int addrconf_notify(struct notifi
 {
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 	struct inet6_dev *idev = __in6_dev_get(dev);
+	struct net *net = dev_net(dev);
 	int run_pending = 0;
 	int err;
 

@@ -2925,7 +2926,7 @@ static int addrconf_notify(struct notifi
 			 * IPV6_MIN_MTU stop IPv6 on this interface.
 			 */
 			if (dev->mtu < IPV6_MIN_MTU)
-				addrconf_ifdown(dev, 1);
+				addrconf_ifdown(dev, dev != net->loopback_dev);
 		}
 		break;
 

Patches currently in stable-queue which might be from [email protected] are

queue-3.18/ipv6-avoid-unregistering-inet6_dev-for-loopback.patch queue-3.18/tcp-reset-sk_rx_dst-in-tcp_disconnect.patch