[PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[Yingjie Wang]

ipv6_create_tempaddr() raises a temporary address's preferred lifetime to
regen_advance + age + 1 when the configured lifetime is too short. The
result is stored in a u32, while regen_advance and age are unsigned long.
If the sum wraps or is truncated, the stored lifetime can still be less
than or equal to regen_advance + age.

addrconf_verify_rtnl() then sees the new address as due for regeneration
and creates another one. Temporary addresses are not limited by
max_addresses since commit 4b08a8f1bd8c ("ipv6: remove max_addresses
check from ipv6_create_tempaddr"), so this can cause unbounded address
growth. With dad_transmits set to -1, a baseline kernel reached 2859
loopback addresses in two seconds.

After storing the adjusted lifetime, verify that it is still greater than
regen_advance + age. Reject the new address if the check fails.

On an x86-64 KASAN kernel, the normal configuration created three IPv6
addresses. The negative dad_transmits, positive multiplication overflow,
and large retransmission-time cases each left only the loopback and public
addresses. An i386 defconfig and an x86-64 allmodconfig both built
addrconf.o with W=1.

Fixes: f4bcbf360ac8 ("net: ipv6/addrconf: clamp preferred_lft to the minimum required")
Cc: stable@vger.kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/netdev/20261029175827.GA1411453@shredder/
Signed-off-by: Yingjie Wang <1075151112@qq.com>
---
Changes in v3:
- Replace the broad input and arithmetic changes with the post-assignment
  check suggested by Ido Schimmel.
- Preserve the existing sysctl interface and leave the advance calculation,
  desynchronization handling and verification path unchanged.
- Rebase onto net/main at 5838f10563d5 and rerun the focused runtime and
  cross-architecture build checks.

 net/ipv6/addrconf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c8c0dd04982d9..d9d13e78bf13b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1487,7 +1487,8 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
 	age = (now - tmp_tstamp + ADDRCONF_TIMER_FUZZ_MINUS) / HZ;
 	if (cfg.preferred_lft <= regen_advance + age) {
 		cfg.preferred_lft = regen_advance + age + 1;
-		if (cfg.preferred_lft > cfg.valid_lft ||
+		if (cfg.preferred_lft <= regen_advance + age ||
+		    cfg.preferred_lft > cfg.valid_lft ||
 		    cfg.preferred_lft > if_public_preferred_lft) {
 			in6_ifa_put(ifp);
 			in6_dev_put(idev);

base-commit: 5838f10563d58afca6711edb5e4eda968ca181d9

Re: [PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v3] ipv6: reject wrapped temporary address preferred lifetimes

[Ido Schimmel]

On Fri, Oct 30, 2026 at 03:30:56PM +0800, Yingjie Wang wrote:
> ipv6_create_tempaddr() raises a temporary address's preferred lifetime to
> regen_advance + age + 1 when the configured lifetime is too short. The
> result is stored in a u32, while regen_advance and age are unsigned long.
> If the sum wraps or is truncated, the stored lifetime can still be less
> than or equal to regen_advance + age.
> 
> addrconf_verify_rtnl() then sees the new address as due for regeneration
> and creates another one. Temporary addresses are not limited by
> max_addresses since commit 4b08a8f1bd8c ("ipv6: remove max_addresses
> check from ipv6_create_tempaddr"), so this can cause unbounded address
> growth. With dad_transmits set to -1, a baseline kernel reached 2859
> loopback addresses in two seconds.
> 
> After storing the adjusted lifetime, verify that it is still greater than
> regen_advance + age. Reject the new address if the check fails.
> 
> On an x86-64 KASAN kernel, the normal configuration created three IPv6
> addresses. The negative dad_transmits, positive multiplication overflow,
> and large retransmission-time cases each left only the loopback and public
> addresses. An i386 defconfig and an x86-64 allmodconfig both built
> addrconf.o with W=1.
> 
> Fixes: f4bcbf360ac8 ("net: ipv6/addrconf: clamp preferred_lft to the minimum required")
> Cc: stable@vger.kernel.org
> Suggested-by: Ido Schimmel <idosch@nvidia.com>
> Link: https://lore.kernel.org/netdev/20261029175827.GA1411453@shredder/
> Signed-off-by: Yingjie Wang <1075151112@qq.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>