| Message ID | tencent_0D7FA5355C7998793C100B23@qq.com |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
--- net/xfrm/xfrm_policy.c_old 2014-02-10 10:18:28.421504317 +0800 +++ net/xfrm/xfrm_policy.c 2014-02-10 10:19:01.661503334 +0800 @@ -330,7 +330,6 @@ static void xfrm_queue_purge(struct sk_b static void xfrm_policy_kill(struct xfrm_policy *policy) { - policy->walk.dead = 1; atomic_inc(&policy->genid); @@ -1156,6 +1155,7 @@ static struct xfrm_policy *__xfrm_policy if (hlist_unhashed(&pol->bydst)) return NULL; + pol->walk.dead = 1; hlist_del(&pol->bydst); hlist_del(&pol->byidx); list_del(&pol->walk.all);
Hi Group, I found a problem about xfrm policy. In corner case, xfrm policy node will be double unlinked from the list. The scenario like this: In thread context, After removed the node from list, before remove the xfrm policy expire timer. At this point, a timer interrupt come, and call the run_timer_softirq to execute the xfrm_policy_timer to remove the expired policy node; because this policy node had already removed from list. this remove will cause the node double unlinked. I have done such patch to protect this case. I am not sure here the policy->walk.dead means. From the name, I think it mark the policy node was dead. Maybe I use this flag is not correct, please the expert correct me if I am wrong. More detail information can reference bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=70471 my patch: ------------------ Best Regards Xianpeng