From f14c9a9cd3cea23bfc90115f803b69e7d865fdcd Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 27 Jun 2019 14:03:32 +0200 Subject: [PATCH] net: ipv4: fix infinite loop on secondary addr promotion secondary address promotion causes infinite loop -- it arranges for ifa->ifa_next to point back to itself. Problem is that 'prev_prom' and 'last_prim' might point at the same entry, so 'last_sec' pointer must be obtained after prev_prom->next update. Fixes: a062ebaf8b1c ("net: ipv4: provide __rcu annotation for ifa_list") Reported-by: Ran Rozenstein Reported-by: Tariq Toukan Signed-off-by: Florian Westphal Signed-off-by: David S. Miller --- net/ipv4/devinet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 7874303220c50..137d1892395d3 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -428,8 +428,9 @@ no_promotions: if (prev_prom) { struct in_ifaddr *last_sec; - last_sec = rtnl_dereference(last_prim->ifa_next); rcu_assign_pointer(prev_prom->ifa_next, next_sec); + + last_sec = rtnl_dereference(last_prim->ifa_next); rcu_assign_pointer(promote->ifa_next, last_sec); rcu_assign_pointer(last_prim->ifa_next, promote); } -- 2.39.5