summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorAlex Henrie <alexhenrie24@gmail.com>2023-08-31 22:41:27 -0600
committerDavid S. Miller <davem@davemloft.net>2023-09-04 07:07:30 +0100
commitf31867d0d9d82af757c1e0178b659438f4c1ea3c (patch)
tree36ddf17125eeed141d28e332f496b45dd9835853 /net
parent151e887d8ff97e2e42110ffa1fb1e6a2128fb364 (diff)
downloadlinux-f31867d0d9d82af757c1e0178b659438f4c1ea3c.tar.gz
linux-f31867d0d9d82af757c1e0178b659438f4c1ea3c.tar.bz2
linux-f31867d0d9d82af757c1e0178b659438f4c1ea3c.zip
net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
The existing code incorrectly casted a negative value (the result of a subtraction) to an unsigned value without checking. For example, if /proc/sys/net/ipv6/conf/*/temp_prefered_lft was set to 1, the preferred lifetime would jump to 4 billion seconds. On my machine and network the shortest lifetime that avoided underflow was 3 seconds. Fixes: 76506a986dc3 ("IPv6: fix DESYNC_FACTOR") Signed-off-by: Alex Henrie <alexhenrie24@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv6/addrconf.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 47d1dd8501b7..85cdbc252654 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1378,7 +1378,7 @@ retry:
* idev->desync_factor if it's larger
*/
cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
- max_desync_factor = min_t(__u32,
+ max_desync_factor = min_t(long,
idev->cnf.max_desync_factor,
cnf_temp_preferred_lft - regen_advance);