diff options
author | Hangbin Liu <liuhangbin@gmail.com> | 2017-06-11 09:44:20 +0800 |
---|---|---|
committer | Steffen Klassert <steffen.klassert@secunet.com> | 2017-06-12 11:51:21 +0200 |
commit | 138437f591dd9a42d53c6fed1a3c85e02678851c (patch) | |
tree | b2ab938ab6fb1958f50067f1252968af9ef88162 /net/xfrm/xfrm_policy.c | |
parent | b81f884a547b5c264c13fdfaa3b65cf994bf1dcf (diff) | |
download | linux-stable-138437f591dd9a42d53c6fed1a3c85e02678851c.tar.gz linux-stable-138437f591dd9a42d53c6fed1a3c85e02678851c.tar.bz2 linux-stable-138437f591dd9a42d53c6fed1a3c85e02678851c.zip |
xfrm: move xfrm_garbage_collect out of xfrm_policy_flush
Now we will force to do garbage collection if any policy removed in
xfrm_policy_flush(). But during xfrm_net_exit(). We call flow_cache_fini()
first and set set fc->percpu to NULL. Then after we call xfrm_policy_fini()
-> frxm_policy_flush() -> flow_cache_flush(), we will get NULL pointer
dereference when check percpu_empty. The code path looks like:
flow_cache_fini()
- fc->percpu = NULL
xfrm_policy_fini()
- xfrm_policy_flush()
- xfrm_garbage_collect()
- flow_cache_flush()
- flow_cache_percpu_empty()
- fcp = per_cpu_ptr(fc->percpu, cpu)
To reproduce, just add ipsec in netns and then remove the netns.
v2:
As Xin Long suggested, since only two other places need to call it. move
xfrm_garbage_collect() outside xfrm_policy_flush().
v3:
Fix subject mismatch after v2 fix.
Fixes: 35db06912189 ("xfrm: do the garbage collection after flushing policy")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm/xfrm_policy.c')
-rw-r--r-- | net/xfrm/xfrm_policy.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index ed4e52d95172..643a18f72032 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1006,10 +1006,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid) err = -ESRCH; out: spin_unlock_bh(&net->xfrm.xfrm_policy_lock); - - if (cnt) - xfrm_garbage_collect(net); - return err; } EXPORT_SYMBOL(xfrm_policy_flush); |