Messages in this thread | | | Date | Mon, 23 Mar 2020 10:00:21 +0200 | From | Timo Teras <> | Subject | Re: [PATCH v3] xfrm: policy: Fix doulbe free in xfrm_policy_timer |
| |
On Mon, 23 Mar 2020 15:32:39 +0800 YueHaibing <yuehaibing@huawei.com> wrote:
> After xfrm_add_policy add a policy, its ref is 2, then > > xfrm_policy_timer > read_lock > xp->walk.dead is 0 > .... > mod_timer() > xfrm_policy_kill > policy->walk.dead = 1 > .... > del_timer(&policy->timer) > xfrm_pol_put //ref is 1 > xfrm_pol_put //ref is 0 > xfrm_policy_destroy > call_rcu > xfrm_pol_hold //ref is 1 > read_unlock > xfrm_pol_put //ref is 0 > xfrm_policy_destroy > call_rcu > > xfrm_policy_destroy is called twice, which may leads to > double free. > > Call Trace: > RIP: 0010:refcount_warn_saturate+0x161/0x210 > ... > xfrm_policy_timer+0x522/0x600 > call_timer_fn+0x1b3/0x5e0 > ? __xfrm_decode_session+0x2990/0x2990 > ? msleep+0xb0/0xb0 > ? _raw_spin_unlock_irq+0x24/0x40 > ? __xfrm_decode_session+0x2990/0x2990 > ? __xfrm_decode_session+0x2990/0x2990 > run_timer_softirq+0x5c5/0x10e0 > > Fix this by use write_lock_bh in xfrm_policy_kill. > > Fixes: ea2dea9dacc2 ("xfrm: remove policy lock when accessing policy->walk.dead") > Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Timo Teräs <timo.teras@iki.fi>
> --- > v3: Only lock 'policy->walk.dead' > v2: Fix typo 'write_lock_bh'--> 'write_unlock_bh' while unlocking > --- > net/xfrm/xfrm_policy.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c > index dbda08ec566e..8a4af86a285e 100644 > --- a/net/xfrm/xfrm_policy.c > +++ b/net/xfrm/xfrm_policy.c > @@ -434,7 +434,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy); > > static void xfrm_policy_kill(struct xfrm_policy *policy) > { > + write_lock_bh(&policy->lock); > policy->walk.dead = 1; > + write_unlock_bh(&policy->lock); > > atomic_inc(&policy->genid); > > -- > 2.17.1 > >
| |