lkml.org 
[lkml]   [2022]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
On Wed, Jun 01, 2022 at 02:46:25PM +0800, Hangyu Hua wrote:
> xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of
> pols[0]. This refcount can be dropped in xfrm_expand_policies() when
> xfrm_expand_policies() return error. pols[0]'s refcount is balanced in
> here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with
> num_pols == 1 to drop this refcount when xfrm_expand_policies() return
> error.
>
> This patch also fix an illegal address access. pols[0] will save a error
> point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve
> an illegal address in xfrm_bundle_lookup's error path.
>
> Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path.
>
> Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing flows")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>

Applied, thanks!

\
 
 \ /
  Last update: 2022-06-04 09:41    [W:0.044 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site