Rabin Vincent c86872a434 ipv6: Fix idev->addr_list corruption
[ Upstream commit a2d6cbb0670d54806f18192cb0db266b4a6d285a ]

addrconf_ifdown() removes elements from the idev->addr_list without
holding the idev->lock.

If this happens while the loop in __ipv6_dev_get_saddr() is handling the
same element, that function ends up in an infinite loop:

  NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
  Call Trace:
   ipv6_get_saddr_eval+0x13c/0x3a0
   __ipv6_dev_get_saddr+0xe4/0x1f0
   ipv6_dev_get_saddr+0x1b4/0x204
   ip6_dst_lookup_tail+0xcc/0x27c
   ip6_dst_lookup_flow+0x38/0x80
   udpv6_sendmsg+0x708/0xba8
   sock_sendmsg+0x18/0x30
   SyS_sendto+0xb8/0xf8
   syscall_common+0x34/0x58

Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
Signed-off-by: Rabin Vincent <rabinv@axis.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-05-03 08:36:36 -07:00
..
2016-10-20 14:32:22 -04:00
2016-12-05 14:48:48 -05:00
2016-12-03 23:54:25 -05:00
2016-07-05 14:08:47 -07:00
2017-05-03 08:36:36 -07:00
2016-05-29 22:33:25 -07:00
2016-10-20 11:23:08 -04:00
2016-12-02 14:03:20 -05:00
2016-06-09 23:41:03 -07:00
2016-08-17 19:36:23 -04:00
2016-08-17 19:36:23 -04:00