Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a9e9cea authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

net: ipv4: fix infinite loop on secondary addr promotion 



secondary address promotion causes infinite loop -- it arranges
for ifa->ifa_next to point back to itself.

Problem is that 'prev_prom' and 'last_prim' might point at the same entry,
so 'last_sec' pointer must be obtained after prev_prom->next update.

Fixes: 2638eb8b ("net: ipv4: provide __rcu annotation for ifa_list")
Reported-by: default avatarRan Rozenstein <ranro@mellanox.com>
Reported-by: default avatarTariq Toukan <tariqt@mellanox.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b9469a2

net/ipv4/devinet.c

+2 −1
Original line number Diff line number Diff line
@@ -428,8 +428,9 @@ static void __inet_del_ifa(struct in_device *in_dev, 
		if (prev_prom) {

			struct in_ifaddr *last_sec;



			last_sec = rtnl_dereference(last_prim->ifa_next);

			rcu_assign_pointer(prev_prom->ifa_next, next_sec);



			last_sec = rtnl_dereference(last_prim->ifa_next);

			rcu_assign_pointer(promote->ifa_next, last_sec);

			rcu_assign_pointer(last_prim->ifa_next, promote);

		}