Messages in this thread | | | Date | Wed, 25 Mar 2020 13:53:56 +0100 | From | Steffen Klassert <> | Subject | Re: [PATCH v3] xfrm: policy: Fix doulbe free in xfrm_policy_timer |
| |
On Mon, Mar 23, 2020 at 03:32:39PM +0800, YueHaibing wrote: > After xfrm_add_policy add a policy, its ref is 2, then > > xfrm_policy_timer > read_lock > xp->walk.dead is 0 > .... > mod_timer() > xfrm_policy_kill > policy->walk.dead = 1 > .... > del_timer(&policy->timer) > xfrm_pol_put //ref is 1 > xfrm_pol_put //ref is 0 > xfrm_policy_destroy > call_rcu > xfrm_pol_hold //ref is 1 > read_unlock > xfrm_pol_put //ref is 0 > xfrm_policy_destroy > call_rcu > > xfrm_policy_destroy is called twice, which may leads to > double free. > > Call Trace: > RIP: 0010:refcount_warn_saturate+0x161/0x210 > ... > xfrm_policy_timer+0x522/0x600 > call_timer_fn+0x1b3/0x5e0 > ? __xfrm_decode_session+0x2990/0x2990 > ? msleep+0xb0/0xb0 > ? _raw_spin_unlock_irq+0x24/0x40 > ? __xfrm_decode_session+0x2990/0x2990 > ? __xfrm_decode_session+0x2990/0x2990 > run_timer_softirq+0x5c5/0x10e0 > > Fix this by use write_lock_bh in xfrm_policy_kill. > > Fixes: ea2dea9dacc2 ("xfrm: remove policy lock when accessing policy->walk.dead") > Signed-off-by: YueHaibing <yuehaibing@huawei.com> > --- > v3: Only lock 'policy->walk.dead' > v2: Fix typo 'write_lock_bh'--> 'write_unlock_bh' while unlocking > ---
Applied, thanks everyone!
| |