mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-22 17:01:14 +00:00
Code Issues Releases Wiki Activity
No description
724498 commits 104 branches 5070 tags 5.5 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Find a file
YueHaibing dc0ea9b710 xfrm: policy: Fix doulbe free in xfrm_policy_timer 
commit 4c59406ed0 upstream.

After xfrm_add_policy add a policy, its ref is 2, then

                             xfrm_policy_timer
                               read_lock
                               xp->walk.dead is 0
                               ....
                               mod_timer()
xfrm_policy_kill
  policy->walk.dead = 1
  ....
  del_timer(&policy->timer)
    xfrm_pol_put //ref is 1
  xfrm_pol_put  //ref is 0
    xfrm_policy_destroy
      call_rcu
                                 xfrm_pol_hold //ref is 1
                               read_unlock
                               xfrm_pol_put //ref is 0
                                 xfrm_policy_destroy
                                  call_rcu

xfrm_policy_destroy is called twice, which may leads to
double free.

Call Trace:
RIP: 0010:refcount_warn_saturate+0x161/0x210
...
 xfrm_policy_timer+0x522/0x600
 call_timer_fn+0x1b3/0x5e0
 ? __xfrm_decode_session+0x2990/0x2990
 ? msleep+0xb0/0xb0
 ? _raw_spin_unlock_irq+0x24/0x40
 ? __xfrm_decode_session+0x2990/0x2990
 ? __xfrm_decode_session+0x2990/0x2990
 run_timer_softirq+0x5c5/0x10e0

Fix this by use write_lock_bh in xfrm_policy_kill.

Fixes: ea2dea9dac ("xfrm: remove policy lock when accessing policy->walk.dead")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Timo Teräs <timo.teras@iki.fi>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02 16:34:32 +02:00
arch ARM: dts: omap5: Add bus_dma_limit for L3 bus 2020-04-02 16:34:29 +02:00
block block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() 2020-04-02 16:34:15 +02:00
certs Replace magic for trusting the secondary keyring with #define 2018-09-09 19:55:54 +02:00
crypto crypto: api - Fix race condition in crypto_spawn_alg 2020-02-14 16:32:14 -05:00
Documentation dt-bindings: net: FMan erratum A050385 2020-04-02 16:34:27 +02:00
drivers RDMA/mlx5: Block delay drop to unprivileged users 2020-04-02 16:34:32 +02:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:20:30 +01:00
fs futex: Fix inode life-time issue 2020-04-02 16:34:21 +02:00
include Input: avoid BIT() macro usage in the serio.h UAPI header 2020-04-02 16:34:29 +02:00
init fork: fix some -Wmissing-prototypes warnings 2019-12-05 15:37:52 +01:00
ipc Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" 2020-02-28 16:36:12 +01:00
kernel genirq: Fix reference leaks on irq affinity notifiers 2020-04-02 16:34:31 +02:00
lib lib/stackdepot.c: fix global out-of-bounds in stack_slabs 2020-02-28 16:36:13 +01:00
mm x86/mm: split vmalloc_sync_all() 2020-04-02 16:34:20 +02:00
net xfrm: policy: Fix doulbe free in xfrm_policy_timer 2020-04-02 16:34:32 +02:00
samples samples/bpf: Don't try to remove user's homedir on clean 2020-02-14 16:32:13 -05:00
scripts scripts/dtc: Remove redundant YYLOC global declaration 2020-04-02 16:34:30 +02:00
security selinux: ensure we cleanup the internal AVC counters on error in avc_update() 2020-02-28 16:36:09 +01:00
sound ALSA: hda/realtek: Fix pop noise on ALC225 2020-04-02 16:34:22 +02:00
tools tools: Let O= makes handle a relative path with -C option 2020-04-02 16:34:30 +02:00
usr kbuild: clean compressed initramfs image 2019-10-07 18:55:14 +02:00
virt KVM: Check for a bad hva before dropping into the ghc slow path 2020-03-11 18:02:53 +01:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS MAINTAINERS: Update drm/i915 bug filing URL 2020-02-28 16:36:12 +01:00
Makefile Linux 4.14.174 2020-03-20 10:54:27 +01:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.