Messages in this thread | | | Date | Fri, 15 Mar 2019 14:24:38 +0800 | From | Herbert Xu <> | Subject | Re: [PATCH] xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module |
| |
On Thu, Mar 14, 2019 at 02:59:42PM +0800, Su Yanjun wrote: > When unloading xfrm6_tunnel module, xfrm6_tunnel_fini directly > frees the xfrm6_tunnel_spi_kmem. Maybe someone has gotten the > xfrm6_tunnel_spi, so need to wait it. > > Fixes: 91cc3bb0b04ff("xfrm6_tunnel: RCU conversion") > Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com> > --- > net/ipv6/xfrm6_tunnel.c | 4 ++++ > 1 file changed, 4 insertions(+)
This looks good to me. And it's not just the matter of accessing freed memory. A worse problem would be trying to execute code from an unloaded module.
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
> diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c > index bc65db7..12cb3aa 100644 > --- a/net/ipv6/xfrm6_tunnel.c > +++ b/net/ipv6/xfrm6_tunnel.c > @@ -402,6 +402,10 @@ static void __exit xfrm6_tunnel_fini(void) > xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); > xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); > unregister_pernet_subsys(&xfrm6_tunnel_net_ops); > + /* Someone maybe has gotten the xfrm6_tunnel_spi. > + * So need to wait it. > + */ > + rcu_barrier(); > kmem_cache_destroy(xfrm6_tunnel_spi_kmem); > }
Thanks, -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
| |