Re: [PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[Alex Henrie]

On Fri, Oct 30, 2026 at 7:43 AM Ido Schimmel <idosch@xxxxxxxxxx> wrote:
>
> On Fri, Oct 30, 2026 at 03:30:56PM +0800, Yingjie Wang wrote:
> > ipv6_create_tempaddr() raises a temporary address's preferred lifetime to
> > regen_advance + age + 1 when the configured lifetime is too short. The
> > result is stored in a u32, while regen_advance and age are unsigned long.
> > If the sum wraps or is truncated, the stored lifetime can still be less
> > than or equal to regen_advance + age.
> >
> > addrconf_verify_rtnl() then sees the new address as due for regeneration
> > and creates another one. Temporary addresses are not limited by
> > max_addresses since commit 4b08a8f1bd8c ("ipv6: remove max_addresses
> > check from ipv6_create_tempaddr"), so this can cause unbounded address
> > growth. With dad_transmits set to -1, a baseline kernel reached 2859
> > loopback addresses in two seconds.
> >
> > After storing the adjusted lifetime, verify that it is still greater than
> > regen_advance + age. Reject the new address if the check fails.
> >
> > On an x86-64 KASAN kernel, the normal configuration created three IPv6
> > addresses. The negative dad_transmits, positive multiplication overflow,
> > and large retransmission-time cases each left only the loopback and public
> > addresses. An i386 defconfig and an x86-64 allmodconfig both built
> > addrconf.o with W=1.
> >
> > Fixes: f4bcbf360ac8 ("net: ipv6/addrconf: clamp preferred_lft to the minimum required")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Suggested-by: Ido Schimmel <idosch@xxxxxxxxxx>
> > Link: https://lore.kernel.org/netdev/20261029175827.GA1411453@shredder/
> > Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
>
> Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>

Reviewed-by: Alex Henrie <alexhenrie24@xxxxxxxxx>