YueHaibing 21af83e17f xfrm: policy: Fix doulbe free in xfrm_policy_timer ... commit 4c59406ed0 upstream. After xfrm_add_policy add a policy, its ref is 2, then xfrm_policy_timer read_lock xp->walk.dead is 0 .... mod_timer() xfrm_policy_kill policy->walk.dead = 1 .... del_timer(&policy->timer) xfrm_pol_put //ref is 1 xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_pol_hold //ref is 1 read_unlock xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_policy_destroy is called twice, which may leads to double free. Call Trace: RIP: 0010:refcount_warn_saturate+0x161/0x210 ... xfrm_policy_timer+0x522/0x600 call_timer_fn+0x1b3/0x5e0 ? __xfrm_decode_session+0x2990/0x2990 ? msleep+0xb0/0xb0 ? _raw_spin_unlock_irq+0x24/0x40 ? __xfrm_decode_session+0x2990/0x2990 ? __xfrm_decode_session+0x2990/0x2990 run_timer_softirq+0x5c5/0x10e0 Fix this by use write_lock_bh in xfrm_policy_kill. Fixes: ea2dea9dac ("xfrm: remove policy lock when accessing policy->walk.dead") Signed-off-by: YueHaibing <yuehaibing@huawei.com> Acked-by: Timo Teräs <timo.teras@iki.fi> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-04-01 11:02:07 +02:00
..
Kconfig	…
Makefile	…
xfrm_algo.c	…
xfrm_device.c	xfrm: handle NETDEV_UNREGISTER for xfrm device	2020-04-01 11:02:05 +02:00
xfrm_hash.c	…
xfrm_hash.h	…
xfrm_inout.h	…
xfrm_input.c	…
xfrm_interface.c	xfrm: interface: do not confirm neighbor when do pmtu update	2020-02-05 21:22:48 +00:00
xfrm_ipcomp.c	…
xfrm_output.c	…
xfrm_policy.c	xfrm: policy: Fix doulbe free in xfrm_policy_timer	2020-04-01 11:02:07 +02:00
xfrm_proc.c	…
xfrm_replay.c	…
xfrm_state.c	…
xfrm_sysctl.c	…
xfrm_user.c	xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire	2020-04-01 11:02:07 +02:00