Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6732bade authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6]: Fix addrconf dead lock. 



We need to release idev->lcok before we call addrconf_dad_stop().
It calls ipv6_addr_del(), which will hold idev->lock.

Bug spotted by Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 79cac2a2

net/ipv6/addrconf.c

+5 −4
Original line number Diff line number Diff line
@@ -2467,11 +2467,9 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags) 
		return;

	}



	if (idev->if_flags & IF_READY) {

		addrconf_dad_kick(ifp);

		spin_unlock_bh(&ifp->lock);

	} else {

	if (!(idev->if_flags & IF_READY)) {

		spin_unlock_bh(&ifp->lock);

		read_unlock_bh(&idev->lock);

		/*

		 * If the defice is not ready:

		 * - keep it tentative if it is a permanent address.
@@ -2479,7 +2477,10 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags) 
		 */

		in6_ifa_hold(ifp);

		addrconf_dad_stop(ifp);

		return;

	}

	addrconf_dad_kick(ifp);

	spin_unlock_bh(&ifp->lock);

out:

	read_unlock_bh(&idev->lock);

}