In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD<\/p>\n
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD
\nvia addrconf_dad_end(), which drops ifp->lock on return. The lock
\nis re-acquired after net_info_ratelimited(). A concurrent
\nipv6_del_addr() can take the lock in that window, set ifp->state
\nto DEAD and run list_del_rcu(&ifp->if_list).<\/p>\n
addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:
\nand schedules a new dad_work. The work calls ipv6_del_addr()
\nagain, hitting the already-poisoned list entry:<\/p>\n
general protection fault: 0000 [#1] SMP NOPTI
\n CPU: 4 PID: 217 Comm: kworker\/4:1
\n Workqueue: ipv6_addrconf addrconf_dad_work
\n RIP: 0010:ipv6_del_addr+0xe9\/0x280
\n RAX: dead000000000122
\n Call Trace:
\n addrconf_dad_stop+0x113\/0x140
\n addrconf_dad_work+0x28c\/0x430
\n process_one_work+0x1eb\/0x3b0
\n worker_thread+0x4d\/0x400
\n kthread+0x104\/0x140
\n ret_from_fork+0x35\/0x40<\/p>\n
Fold the addrconf_dad_end() logic into addrconf_dad_failure() under
\na single ifp->lock critical section. The STABLE_PRIVACY branch
\ntemporarily drops ifp->lock around address regeneration, so at
\nlock_errdad: verify the state is still POSTDAD before transitioning
\nto ERRDAD; bail out otherwise to avoid overwriting a state set by
\nanother path while the lock was released.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD<\/p>\n
addrconf_dad_failure() transitions ifp->state from DAD to <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7352","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}