diff options
| author | Rabin Vincent <rabinv@axis.com> | 2017-04-10 08:36:39 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-04-12 13:23:39 -0400 |
| commit | a2d6cbb0670d54806f18192cb0db266b4a6d285a (patch) | |
| tree | b1e8048ca0a255ece74d79c3e9095c2b99e265ce /kernel/bpf/arraymap.c | |
| parent | df7dd8fc965c665e83b71a649378cdf200ff36df (diff) | |
ipv6: Fix idev->addr_list corruption
addrconf_ifdown() removes elements from the idev->addr_list without
holding the idev->lock.
If this happens while the loop in __ipv6_dev_get_saddr() is handling the
same element, that function ends up in an infinite loop:
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
Call Trace:
ipv6_get_saddr_eval+0x13c/0x3a0
__ipv6_dev_get_saddr+0xe4/0x1f0
ipv6_dev_get_saddr+0x1b4/0x204
ip6_dst_lookup_tail+0xcc/0x27c
ip6_dst_lookup_flow+0x38/0x80
udpv6_sendmsg+0x708/0xba8
sock_sendmsg+0x18/0x30
SyS_sendto+0xb8/0xf8
syscall_common+0x34/0x58
Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
Signed-off-by: Rabin Vincent <rabinv@axis.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/bpf/arraymap.c')
0 files changed, 0 insertions, 0 deletions