leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b223856640
linux/net
History
Andrey Vagin b223856640 ipv6: fix race between ipv6_del_addr and DAD timer 
Consider the following scenario:

ipv6_del_addr(ifp)
  ipv6_ifa_notify(RTM_DELADDR, ifp)
    ip6_del_rt(ifp->rt)

after returning from the ipv6_ifa_notify and enabling BH-s
back, but *before* calling the addrconf_del_timer the 
ifp->timer fires and:

addrconf_dad_timer(ifp)
  addrconf_dad_completed(ifp)
    ipv6_ifa_notify(RTM_NEWADDR, ifp)
      ip6_ins_rt(ifp->rt)

then return back to the ipv6_del_addr and:

in6_ifa_put(ifp)
  inet6_ifa_finish_destroy(ifp)
    dst_release(&ifp->rt->u.dst)

After this we have an ifp->rt inserted into fib6 lists, but 
queued for gc, which in turn can result in oopses in the
fib6_run_gc. Maybe some other nasty things, but we caught 
only the oops in gc so far.

The solution is to disarm the ifp->timer before flushing the
rt from it.

Signed-off-by: Andrey Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-07-08 15:13:31 -07:00
..
9p 9p: fix error path during early mount 2008-05-14 19:23:27 -05:00
802
8021q vlan: Use bitmask of feature flags instead of seperate feature bits 2008-05-23 00:27:50 -07:00
appletalk [NET] NETNS: Omit net_device->nd_net without CONFIG_NET_NS. 2008-03-26 04:39:53 +09:00
atm atm: [br2864] fix routed vcmux support 2008-06-16 17:18:18 -07:00
ax25 ax25: Fix NULL pointer dereference and lockup. 2008-06-03 14:53:46 -07:00
bluetooth bluetooth: rfcomm_dev_state_change deadlock fix 2008-06-03 14:27:17 -07:00
bridge bridge: fix use-after-free in br_cleanup_bridges() 2008-07-03 03:53:42 -07:00
can can: add sanity checks 2008-07-05 23:38:43 -07:00
core net: fib_rules: fix error code for unsupported families 2008-07-01 19:59:37 -07:00
dccp dccp: Bug in initial acknowledgment number assignment 2008-06-11 11:19:10 +01:00
decnet ip: Use inline function dst_metric() instead of direct access to dst->metric[] 2008-05-04 22:14:42 -07:00
econet net: Allow netdevices to specify needed head/tailroom 2008-05-12 20:48:31 -07:00
ethernet [NET]: Return more appropriate error from eth_validate_addr(). 2008-04-13 22:45:40 -07:00
ieee80211 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-04-14 02:30:23 -07:00
ipv4 tcp: fix a size_t < 0 comparison in tcp_read_sock 2008-07-03 03:31:21 -07:00
ipv6 ipv6: fix race between ipv6_del_addr and DAD timer 2008-07-08 15:13:31 -07:00
ipx [NET] NETNS: Omit net_device->nd_net without CONFIG_NET_NS. 2008-03-26 04:39:53 +09:00
irda irda: Fix netlink error path return value 2008-07-08 03:07:43 -07:00
iucv iucv: Delay bus registration until core is ready. 2008-04-10 02:12:45 -07:00
key ipsec: pfkey should ignore events when no listeners 2008-06-10 14:25:34 -07:00
lapb
llc llc: Fix double accounting of received packets 2008-05-30 02:57:29 -07:00
mac80211 mac80211: don't report selected IBSS when not found 2008-07-07 15:31:40 -04:00
netfilter netfilter: nf_conntrack_tcp: fixing to check the lower bound of valid ACK 2008-06-30 12:41:30 -07:00
netlabel netlabel: Fix a problem when dumping the default IPv6 static labels 2008-06-27 20:12:32 -07:00
netlink netlink: Unneeded local variable 2008-07-01 19:55:09 -07:00
netrom [NET] NETNS: Omit sock->sk_net without CONFIG_NET_NS. 2008-03-26 04:39:55 +09:00
packet net: Allow netdevices to specify needed head/tailroom 2008-05-12 20:48:31 -07:00
rfkill rfkill: Fix device type check when toggling states 2008-04-15 15:04:35 -04:00
rose rose: Wrong list_lock argument in rose_node seqops 2008-05-02 17:03:22 -07:00
rxrpc net: Add missing braces to multi-statement if()s 2008-05-02 16:20:10 -07:00
sched net-sched: fix filter destruction in atm/hfsc qdisc destruction 2008-07-01 19:53:09 -07:00
sctp sctp: Mark the tsn as received after all allocations finish 2008-07-08 02:28:39 -07:00
sunrpc Merge branch 'for-2.6.26' of git://linux-nfs.org/~bfields/linux 2008-05-20 19:30:54 -07:00
tipc tipc: Increase buffer header to support worst-case device 2008-05-08 21:38:24 -07:00
unix af_unix: fix 'poll for write'/connected DGRAM sockets 2008-06-27 19:34:18 -07:00
wanrouter [WANROUTER]: Use proc_create() to setup ->proc_fops first 2008-02-28 14:15:56 -08:00
wireless mac80211: implement EU regulatory domain 2008-06-25 10:31:29 -04:00
x25 [NET] NETNS: Omit sock->sk_net without CONFIG_NET_NS. 2008-03-26 04:39:55 +09:00
xfrm xfrm: xfrm_algo: correct usage of RIPEMD-160 2008-06-04 12:04:55 -07:00
compat.c net: Add compat support for getsockopt (MCAST_MSFILTER) 2008-04-29 03:23:22 -07:00
Kconfig [IPV4]: Fix size description of CONFIG_INET. 2008-03-04 15:18:22 +09:00
Makefile
nonet.c
socket.c net: Unexport move_addr_to_{kernel,user} 2008-04-23 03:37:49 -07:00
sysctl_net.c net: fix returning void-valued expression warnings 2008-05-01 02:47:38 -07:00
TUNABLE