RFC8981 section 3.4 says that existing temporary addresses must have their
lifetimes adjusted so that no temporary addresses should ever remain "valid"
or "preferred" longer than the incoming SLAAC Prefix Information. This would
strongly imply in Linux's case that if the "mngtmpaddr" address is deleted or
un-flagged as such, its corresponding temporary addresses must be cleared out
right away.
But now the temporary address is renewed even after ‘mngtmpaddr’ is removed
or becomes unmanaged. Fix this by deleting the temporary address with this
situation.
Fixes: 778964f2fdf0 ("ipv6/addrconf: fix timing bug in tempaddr regen")
Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxx>
---
net/ipv6/addrconf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 94dceac52884..6852dbce5a7d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4644,6 +4644,10 @@ static void addrconf_verify_rtnl(struct net *net)
!ifp->regen_count && ifp->ifpub) {
/* This is a non-regenerated temporary addr. */
+ if ((!ifp->valid_lft && !ifp->prefered_lft) ||
+ ifp->ifpub->state == INET6_IFADDR_STATE_DEAD)
+ goto delete_ifp;
+
unsigned long regen_advance = ipv6_get_regen_advance(ifp->idev);
if (age + regen_advance >= ifp->prefered_lft) {
@@ -4671,6 +4675,7 @@ static void addrconf_verify_rtnl(struct net *net)
if (ifp->valid_lft != INFINITY_LIFE_TIME &&
age >= ifp->valid_lft) {
+delete_ifp:
spin_unlock(&ifp->lock);
in6_ifa_hold(ifp);
rcu_read_unlock_bh();
--
2.46.0
