diff options
| author | Alex Henrie <alexhenrie24@gmail.com> | 2023-08-31 22:41:27 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-09-23 10:48:13 +0200 |
| commit | 897bd8f5823d28f7e8c9d6cece94b13185f9a213 (patch) | |
| tree | 8beaffa827ecb1c164c4c424738556539236b2ca | |
| parent | bebf4d354cbc7c735706babfc6b89975d22c2d75 (diff) | |
| download | linux-stable-897bd8f5823d28f7e8c9d6cece94b13185f9a213.tar.gz linux-stable-897bd8f5823d28f7e8c9d6cece94b13185f9a213.tar.bz2 linux-stable-897bd8f5823d28f7e8c9d6cece94b13185f9a213.zip | |
net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
[ Upstream commit f31867d0d9d82af757c1e0178b659438f4c1ea3c ]
The existing code incorrectly casted a negative value (the result of a
subtraction) to an unsigned value without checking. For example, if
/proc/sys/net/ipv6/conf/*/temp_prefered_lft was set to 1, the preferred
lifetime would jump to 4 billion seconds. On my machine and network the
shortest lifetime that avoided underflow was 3 seconds.
Fixes: 76506a986dc3 ("IPv6: fix DESYNC_FACTOR")
Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/ipv6/addrconf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5c5c5736f689..5ffa8777ab09 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1321,7 +1321,7 @@ retry: * idev->desync_factor if it's larger */ cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft); - max_desync_factor = min_t(__u32, + max_desync_factor = min_t(long, idev->cnf.max_desync_factor, cnf_temp_preferred_lft - regen_advance); |