Commit 27b10608 authored Apr 18, 2018 by David Ahern Committed by David S. Miller Apr 19, 2018

net/ipv6: Fix gfp_flags arg to addrconf_prefix_route



Eric noticed that __ipv6_ifa_notify is called under rcu_read_lock, so
the gfp argument to addrconf_prefix_route can not be GFP_KERNEL.

While scrubbing other calls I noticed addrconf_addr_gen has one
place with GFP_ATOMIC that can be GFP_KERNEL.

Fixes: acb54e3c ("net/ipv6: Add gfp_flags to route add functions")
Reported-by:  <syzbot+2add39b05179b31f912f@syzkaller.appspotmail.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent dcd1f572

net/ipv6/addrconf.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -3245,7 +3245,7 @@ static void addrconf_addr_gen(struct inet6_dev *idev, bool prefix_route)
		addrconf_add_linklocal(idev, &addr, 0);
		else if (prefix_route)
		addrconf_prefix_route(&addr, 64, idev->dev,
		0, 0, GFP_ATOMIC);
		0, 0, GFP_KERNEL);
		break;
		case IN6_ADDR_GEN_MODE_NONE:
		default:
		@@ -5620,7 +5620,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
		if (!ipv6_addr_any(&ifp->peer_addr))
		addrconf_prefix_route(&ifp->peer_addr, 128,
		ifp->idev->dev, 0, 0,
		GFP_KERNEL);
		GFP_ATOMIC);
		break;
		case RTM_DELADDR:
		if (ifp->idev->cnf.forwarding)