@@ -4644,6 +4644,10 @@ static void addrconf_verify_rtnl(struct net *net)
!ifp->regen_count && ifp->ifpub) {
/* This is a non-regenerated temporary addr. */
+ if ((!ifp->valid_lft && !ifp->prefered_lft) ||
+ ifp->ifpub->state == INET6_IFADDR_STATE_DEAD)
+ goto delete_ifp;
+
unsigned long regen_advance = ipv6_get_regen_advance(ifp->idev);
if (age + regen_advance >= ifp->prefered_lft) {
@@ -4671,6 +4675,7 @@ static void addrconf_verify_rtnl(struct net *net)
if (ifp->valid_lft != INFINITY_LIFE_TIME &&
age >= ifp->valid_lft) {
+delete_ifp:
spin_unlock(&ifp->lock);
in6_ifa_hold(ifp);
rcu_read_unlock_bh();
RFC8981 section 3.4 says that existing temporary addresses must have their lifetimes adjusted so that no temporary addresses should ever remain "valid" or "preferred" longer than the incoming SLAAC Prefix Information. This would strongly imply in Linux's case that if the "mngtmpaddr" address is deleted or un-flagged as such, its corresponding temporary addresses must be cleared out right away. But now the temporary address is renewed even after ‘mngtmpaddr’ is removed or becomes unmanaged. Fix this by deleting the temporary address with this situation. Fixes: 778964f2fdf0 ("ipv6/addrconf: fix timing bug in tempaddr regen") Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- net/ipv6/addrconf.c | 5 +++++ 1 file changed, 5 insertions(+)