Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e13db62d authored by Alex Henrie's avatar Alex Henrie Committed by Greg Kroah-Hartman
Browse files

net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr 



[ Upstream commit f31867d0d9d82af757c1e0178b659438f4c1ea3c ]

The existing code incorrectly casted a negative value (the result of a
subtraction) to an unsigned value without checking. For example, if
/proc/sys/net/ipv6/conf/*/temp_prefered_lft was set to 1, the preferred
lifetime would jump to 4 billion seconds. On my machine and network the
shortest lifetime that avoided underflow was 3 seconds.

Fixes: 76506a98 ("IPv6: fix DESYNC_FACTOR")
Signed-off-by: default avatarAlex Henrie <alexhenrie24@gmail.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 23b4b1a0

net/ipv6/addrconf.c

+1 −1
Original line number Diff line number Diff line
@@ -1367,7 +1367,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, 
	 * idev->desync_factor if it's larger

	 */

	cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);

	max_desync_factor = min_t(__u32,

	max_desync_factor = min_t(long,

				  idev->cnf.max_desync_factor,

				  cnf_temp_preferred_lft - regen_advance);