Re: [PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[Ido Schimmel]

On Fri, Oct 30, 2026 at 03:30:56PM +0800, Yingjie Wang wrote:
> ipv6_create_tempaddr() raises a temporary address's preferred lifetime to
> regen_advance + age + 1 when the configured lifetime is too short. The
> result is stored in a u32, while regen_advance and age are unsigned long.
> If the sum wraps or is truncated, the stored lifetime can still be less
> than or equal to regen_advance + age.
> 
> addrconf_verify_rtnl() then sees the new address as due for regeneration
> and creates another one. Temporary addresses are not limited by
> max_addresses since commit 4b08a8f1bd8c ("ipv6: remove max_addresses
> check from ipv6_create_tempaddr"), so this can cause unbounded address
> growth. With dad_transmits set to -1, a baseline kernel reached 2859
> loopback addresses in two seconds.
> 
> After storing the adjusted lifetime, verify that it is still greater than
> regen_advance + age. Reject the new address if the check fails.
> 
> On an x86-64 KASAN kernel, the normal configuration created three IPv6
> addresses. The negative dad_transmits, positive multiplication overflow,
> and large retransmission-time cases each left only the loopback and public
> addresses. An i386 defconfig and an x86-64 allmodconfig both built
> addrconf.o with W=1.
> 
> Fixes: f4bcbf360ac8 ("net: ipv6/addrconf: clamp preferred_lft to the minimum required")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> Link: https://lore.kernel.org/netdev/20261029175827.GA1411453@shredder/
> Signed-off-by: Yingjie Wang <1075151112@xxxxxx>

Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>