mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-22 17:01:14 +00:00
xfrm: policy: Fix doulbe free in xfrm_policy_timer
commit4c59406ed0
upstream. After xfrm_add_policy add a policy, its ref is 2, then xfrm_policy_timer read_lock xp->walk.dead is 0 .... mod_timer() xfrm_policy_kill policy->walk.dead = 1 .... del_timer(&policy->timer) xfrm_pol_put //ref is 1 xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_pol_hold //ref is 1 read_unlock xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_policy_destroy is called twice, which may leads to double free. Call Trace: RIP: 0010:refcount_warn_saturate+0x161/0x210 ... xfrm_policy_timer+0x522/0x600 call_timer_fn+0x1b3/0x5e0 ? __xfrm_decode_session+0x2990/0x2990 ? msleep+0xb0/0xb0 ? _raw_spin_unlock_irq+0x24/0x40 ? __xfrm_decode_session+0x2990/0x2990 ? __xfrm_decode_session+0x2990/0x2990 run_timer_softirq+0x5c5/0x10e0 Fix this by use write_lock_bh in xfrm_policy_kill. Fixes:ea2dea9dac
("xfrm: remove policy lock when accessing policy->walk.dead") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Timo Teräs <timo.teras@iki.fi> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
25106012e9
commit
dc0ea9b710
1 changed files with 2 additions and 0 deletions
|
@ -301,7 +301,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy);
|
||||||
|
|
||||||
static void xfrm_policy_kill(struct xfrm_policy *policy)
|
static void xfrm_policy_kill(struct xfrm_policy *policy)
|
||||||
{
|
{
|
||||||
|
write_lock_bh(&policy->lock);
|
||||||
policy->walk.dead = 1;
|
policy->walk.dead = 1;
|
||||||
|
write_unlock_bh(&policy->lock);
|
||||||
|
|
||||||
atomic_inc(&policy->genid);
|
atomic_inc(&policy->genid);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue