lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 130/159] xfrm: Update ipcomp_scratches with NULL when freed
    Date
    From: Khalid Masum <khalid.masum.92@gmail.com>

    [ Upstream commit 8a04d2fc700f717104bfb95b0f6694e448a4537f ]

    Currently if ipcomp_alloc_scratches() fails to allocate memory
    ipcomp_scratches holds obsolete address. So when we try to free the
    percpu scratches using ipcomp_free_scratches() it tries to vfree non
    existent vm area. Described below:

    static void * __percpu *ipcomp_alloc_scratches(void)
    {
    ...
    scratches = alloc_percpu(void *);
    if (!scratches)
    return NULL;
    ipcomp_scratches does not know about this allocation failure.
    Therefore holding the old obsolete address.
    ...
    }

    So when we free,

    static void ipcomp_free_scratches(void)
    {
    ...
    scratches = ipcomp_scratches;
    Assigning obsolete address from ipcomp_scratches

    if (!scratches)
    return;

    for_each_possible_cpu(i)
    vfree(*per_cpu_ptr(scratches, i));
    Trying to free non existent page, causing warning: trying to vfree
    existent vm area.
    ...
    }

    Fix this breakage by updating ipcomp_scrtches with NULL when scratches
    is freed

    Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
    Reported-by: syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com
    Tested-by: syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com
    Signed-off-by: Khalid Masum <khalid.masum.92@gmail.com>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/xfrm/xfrm_ipcomp.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
    index a00ec715aa46..32aed1d0f6ee 100644
    --- a/net/xfrm/xfrm_ipcomp.c
    +++ b/net/xfrm/xfrm_ipcomp.c
    @@ -216,6 +216,7 @@ static void ipcomp_free_scratches(void)
    vfree(*per_cpu_ptr(scratches, i));

    free_percpu(scratches);
    + ipcomp_scratches = NULL;
    }

    static void * __percpu *ipcomp_alloc_scratches(void)
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 13:55    [W:3.911 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site