diff options
author | Hangbin Liu <liuhangbin@gmail.com> | 2017-06-11 09:44:20 +0800 |
---|---|---|
committer | Steffen Klassert <steffen.klassert@secunet.com> | 2017-06-12 11:51:21 +0200 |
commit | 138437f591dd9a42d53c6fed1a3c85e02678851c (patch) | |
tree | b2ab938ab6fb1958f50067f1252968af9ef88162 /net/smc/smc_cdc.c | |
parent | b81f884a547b5c264c13fdfaa3b65cf994bf1dcf (diff) | |
download | linux-138437f591dd9a42d53c6fed1a3c85e02678851c.tar.gz linux-138437f591dd9a42d53c6fed1a3c85e02678851c.tar.xz |
xfrm: move xfrm_garbage_collect out of xfrm_policy_flush
Now we will force to do garbage collection if any policy removed in
xfrm_policy_flush(). But during xfrm_net_exit(). We call flow_cache_fini()
first and set set fc->percpu to NULL. Then after we call xfrm_policy_fini()
-> frxm_policy_flush() -> flow_cache_flush(), we will get NULL pointer
dereference when check percpu_empty. The code path looks like:
flow_cache_fini()
- fc->percpu = NULL
xfrm_policy_fini()
- xfrm_policy_flush()
- xfrm_garbage_collect()
- flow_cache_flush()
- flow_cache_percpu_empty()
- fcp = per_cpu_ptr(fc->percpu, cpu)
To reproduce, just add ipsec in netns and then remove the netns.
v2:
As Xin Long suggested, since only two other places need to call it. move
xfrm_garbage_collect() outside xfrm_policy_flush().
v3:
Fix subject mismatch after v2 fix.
Fixes: 35db06912189 ("xfrm: do the garbage collection after flushing policy")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/smc/smc_cdc.c')
0 files changed, 0 insertions, 0 deletions