linux-stable/net
Maciej Żenczykowski 776da4eca0 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
[ Upstream commit 69172f0bcb ]

currently on 6.4 net/main:

  # ip link add dummy1 type dummy
  # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr
  # ip link set dummy1 up
  # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1
  # ip -6 addr show dev dummy1

  11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
      inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic
         valid_lft 604800sec preferred_lft 86172sec
      inet6 2000::1/64 scope global mngtmpaddr
         valid_lft forever preferred_lft forever
      inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
         valid_lft forever preferred_lft forever

  # ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1

  (can wait a few seconds if you want to, the above delete isn't [directly] the problem)

  # ip -6 addr show dev dummy1

  11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
      inet6 2000::1/64 scope global mngtmpaddr
         valid_lft forever preferred_lft forever
      inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
         valid_lft forever preferred_lft forever

  # ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1
  # ip -6 addr show dev dummy1

  11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
      inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic
         valid_lft 604797sec preferred_lft 86169sec
      inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
         valid_lft forever preferred_lft forever

This patch prevents this new 'global temporary dynamic' address from being
created by the deletion of the related (same subnet prefix) 'mngtmpaddr'
(which is triggered by there already being no temporary addresses).

Cc: Jiri Pirko <jiri@resnulli.us>
Fixes: 53bd674915 ("ipv6 addrconf: introduce IFA_F_MANAGETEMPADDR to tell kernel to manage temporary addresses")
Reported-by: Xiao Ma <xiaom@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230720160022.1887942-1-maze@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-03 10:23:59 +02:00
..
6lowpan
9p
802
8021q
appletalk
atm
ax25
batman-adv batman-adv: Broken sync while rescheduling delayed work 2023-06-14 11:15:23 +02:00
bluetooth Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() 2023-07-27 08:50:47 +02:00
bpf
bpfilter
bridge bridge: Add extack warning when enabling STP in netns. 2023-07-27 08:50:40 +02:00
caif
can can: bcm: Fix UAF in bcm_proc_show() 2023-07-27 08:50:27 +02:00
ceph libceph: harden msgr2.1 frame segment length checks 2023-07-23 13:49:41 +02:00
core devlink: report devlink_port_type_warn source device 2023-07-27 08:50:35 +02:00
dcb
dccp
dns_resolver
dsa net: dsa: sja1105: always enable the send_meta options 2023-07-19 16:22:06 +02:00
ethernet
ethtool
hsr
ieee802154
ife
ipv4 tcp: annotate data-races around fastopenq.max_qlen 2023-07-27 08:50:49 +02:00
ipv6 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address 2023-08-03 10:23:59 +02:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc llc: Don't drop packet from non-root netns. 2023-07-27 08:50:45 +02:00
mac80211 wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam 2023-07-19 16:21:09 +02:00
mac802154
mctp
mpls
mptcp mptcp: do not rely on implicit state check in mptcp_listen() 2023-08-03 10:23:54 +02:00
ncsi net/ncsi: change from ndo_set_mac_address to dev_set_mac_address 2023-07-23 13:49:51 +02:00
netfilter netfilter: nf_tables: fix underflow in chain reference counter 2023-08-03 10:23:46 +02:00
netlabel
netlink netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-07-19 16:21:13 +02:00
netrom
nfc net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-07-19 16:21:13 +02:00
nsh
openvswitch
packet
phonet
psample
qrtr
rds
rfkill
rose
rxrpc
sched net: sched: cls_bpf: Undo tcf_bind_filter in case of an error 2023-07-27 08:50:41 +02:00
sctp sctp: fix potential deadlock on &net->sctp.addr_wq_lock 2023-07-19 16:22:00 +02:00
smc
strparser
sunrpc SUNRPC: Fix UAF in svc_tcp_listen_data_ready() 2023-07-19 16:21:48 +02:00
switchdev
tipc net: tipc: resize nlattr array to correct size 2023-06-21 16:01:02 +02:00
tls
unix
vmw_vsock
wireless wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() 2023-07-27 08:50:35 +02:00
x25
xdp xsk: Honor SO_BINDTODEVICE on bind 2023-07-19 16:22:05 +02:00
xfrm xfrm: Ensure policies always checked on XFRM-I input path 2023-06-28 11:12:28 +02:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c
sysctl_net.c