addrconf_dad_end() transitions ifp->state from DAD to POSTDAD under ifp->lock and releases the lock. addrconf_dad_failure() takes ifp->lock again with the spin_lock_bh() following the net_info_ratelimited() duplicate-address log. A concurrent ipv6_del_addr() can acquire the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Bail out at errdad: when ifp->state is already DEAD. The existing in6_ifa_put() releases the reference taken for this invocation. Signed-off-by: Linmao Li --- net/ipv6/addrconf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5476b6536eb7..14b1ab43da87 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2227,6 +2227,12 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) errdad: /* transition from _POSTDAD to _ERRDAD */ + if (ifp->state == INET6_IFADDR_STATE_DEAD) { + /* ipv6_del_addr() already removed ifp while lock was dropped */ + spin_unlock_bh(&ifp->lock); + in6_ifa_put(ifp); + return; + } ifp->state = INET6_IFADDR_STATE_ERRDAD; spin_unlock_bh(&ifp->lock); -- 2.25.1