lkml.org 
[lkml]   [2020]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] xfrm: policy: Fix doulbe free in xfrm_policy_timer
    Date
    After xfrm_add_policy add a policy, its ref is 2, then

    xfrm_policy_timer
    read_lock
    xp->walk.dead is 0
    ....
    mod_timer()
    xfrm_policy_kill
    policy->walk.dead = 1
    ....
    del_timer(&policy->timer)
    xfrm_pol_put //ref is 1
    xfrm_pol_put //ref is 0
    xfrm_policy_destroy
    call_rcu
    xfrm_pol_hold //ref is 1
    read_unlock
    xfrm_pol_put //ref is 0
    xfrm_policy_destroy
    call_rcu

    xfrm_policy_destroy is called twice, which may leads to
    double free.

    Call Trace:
    RIP: 0010:refcount_warn_saturate+0x161/0x210
    ...
    xfrm_policy_timer+0x522/0x600
    call_timer_fn+0x1b3/0x5e0
    ? __xfrm_decode_session+0x2990/0x2990
    ? msleep+0xb0/0xb0
    ? _raw_spin_unlock_irq+0x24/0x40
    ? __xfrm_decode_session+0x2990/0x2990
    ? __xfrm_decode_session+0x2990/0x2990
    run_timer_softirq+0x5c5/0x10e0

    Fix this by add write_lock_bh in xfrm_policy_kill.

    Fixes: ea2dea9dacc2 ("xfrm: remove policy lock when accessing policy->walk.dead")
    Signed-off-by: YueHaibing <yuehaibing@huawei.com>
    ---
    net/xfrm/xfrm_policy.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    index dbda08ec566e..ae0689174bbf 100644
    --- a/net/xfrm/xfrm_policy.c
    +++ b/net/xfrm/xfrm_policy.c
    @@ -434,6 +434,7 @@ EXPORT_SYMBOL(xfrm_policy_destroy);

    static void xfrm_policy_kill(struct xfrm_policy *policy)
    {
    + write_lock_bh(&policy->lock);
    policy->walk.dead = 1;

    atomic_inc(&policy->genid);
    @@ -445,6 +446,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
    if (del_timer(&policy->timer))
    xfrm_pol_put(policy);

    + write_lock_bh(&policy->lock);
    xfrm_pol_put(policy);
    }

    --
    2.17.1

    \
     
     \ /
      Last update: 2020-03-18 04:50    [W:2.596 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site