From patchwork Sun Jun 11 01:44:20 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hangbin Liu X-Patchwork-Id: 774293 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3wlf3m4CvDz9s72 for ; Sun, 11 Jun 2017 11:45:08 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="T97PpPri"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751721AbdFKBpB (ORCPT ); Sat, 10 Jun 2017 21:45:01 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:33035 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751661AbdFKBpA (ORCPT ); Sat, 10 Jun 2017 21:45:00 -0400 Received: by mail-pf0-f196.google.com with SMTP id w12so2622169pfk.0 for ; Sat, 10 Jun 2017 18:45:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=j8Rp/nyHuCtV3c6Upcdan/1Bamc5s+OMAEq/C/+WziI=; b=T97PpPrifQSoJbWWyqT9Cpf2YbRd1pE8USkqCUmLwuZmXqikaw67QAgbVP8zFIvK1B id4X3xKlONJztuGTDW5g/Gi14f2IN1uXZ9TM+M3W0zW+MXFAy8SP+vioU0O2ldgIASiK rD2WAHIKTEuv8j4J9BUMWv+Y4jrJIdTve7NWQdg5myGwOrUASmcUtCz3/8nblnJOpS// hpdbUG3hNAz1UbuV7CH7skoLFjGpjpEKuHq7qokL3MIS228IDourjqwHam1D+/o1RB7M f0ao+G9FhWSWyg8qynBVRGqGQ5MHb3mHPX+U6zeNoyNMnL80sWavUUZbpuv6pVlMUHVo 4uBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=j8Rp/nyHuCtV3c6Upcdan/1Bamc5s+OMAEq/C/+WziI=; b=t8r3TFrVWqIi6m/StBbNIm5HhCvjAE3VQemQ1oR4BnbNJrGokQ3EFkhcoCY138Ds5l Q4NtYOApPudWGld9WZMsWt2TB9IEdv61epDANhZbZF9gSVgxLXHpjFVX0aGVemhcnil8 VJw5vjMs5T3G3iLwSBnj0TjP4NAhwbdM3GbsCfdNCa3jqc3esoCW1I/9F4vyyD/ig0Yj Z5A9s74LPbK4roScp52QMnNAqTxOGYo9iVlSHyuR1ub9t8xwPN1NnCpsu3+m0eW6D4gm dB2egOjTHoa4TWEvfY8wvd4I1bmdfrq3lHq3o+vxdy8iYU5sWauZrIsDbfL7n2ktzxsJ B06Q== X-Gm-Message-State: AODbwcAjDCVjXofxLUGJrf526kEyMvJZcVbHYNWQJ5p21yfVvOgGFlYD qRGCZKbzkyf5VAoX X-Received: by 10.99.97.12 with SMTP id v12mr13730769pgb.232.1497145499726; Sat, 10 Jun 2017 18:44:59 -0700 (PDT) Received: from leo.usersys.redhat.com ([209.132.188.80]) by smtp.gmail.com with ESMTPSA id i2sm9314818pfe.89.2017.06.10.18.44.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 10 Jun 2017 18:44:58 -0700 (PDT) From: Hangbin Liu To: netdev@vger.kernel.org Cc: David Miller , Xin Long , Steffen Klassert , Hangbin Liu Subject: [PATCHv3 net] xfrm: move xfrm_garbage_collect out of xfrm_policy_flush Date: Sun, 11 Jun 2017 09:44:20 +0800 Message-Id: <1497145460-24614-1-git-send-email-liuhangbin@gmail.com> X-Mailer: git-send-email 2.5.5 In-Reply-To: <1497013755-24481-1-git-send-email-liuhangbin@gmail.com> References: <1497013755-24481-1-git-send-email-liuhangbin@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Now we will force to do garbage collection if any policy removed in xfrm_policy_flush(). But during xfrm_net_exit(). We call flow_cache_fini() first and set set fc->percpu to NULL. Then after we call xfrm_policy_fini() -> frxm_policy_flush() -> flow_cache_flush(), we will get NULL pointer dereference when check percpu_empty. The code path looks like: flow_cache_fini() - fc->percpu = NULL xfrm_policy_fini() - xfrm_policy_flush() - xfrm_garbage_collect() - flow_cache_flush() - flow_cache_percpu_empty() - fcp = per_cpu_ptr(fc->percpu, cpu) To reproduce, just add ipsec in netns and then remove the netns. v2: As Xin Long suggested, since only two other places need to call it. move xfrm_garbage_collect() outside xfrm_policy_flush(). v3: Fix subject mismatch after v2 fix. Fixes: 35db06912189 ("xfrm: do the garbage collection after flushing policy") Signed-off-by: Hangbin Liu Reviewed-by: Xin Long --- net/key/af_key.c | 2 ++ net/xfrm/xfrm_policy.c | 4 ---- net/xfrm/xfrm_user.c | 1 + 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index 512dc43..5103f92 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2755,6 +2755,8 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad int err, err2; err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true); + if (!err) + xfrm_garbage_collect(net); err2 = unicast_flush_resp(sk, hdr); if (err || err2) { if (err == -ESRCH) /* empty table - old silent behavior */ diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index ed4e52d..643a18f 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1006,10 +1006,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid) err = -ESRCH; out: spin_unlock_bh(&net->xfrm.xfrm_policy_lock); - - if (cnt) - xfrm_garbage_collect(net); - return err; } EXPORT_SYMBOL(xfrm_policy_flush); diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 38614df..86116e9 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2027,6 +2027,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, return 0; return err; } + xfrm_garbage_collect(net); c.data.type = type; c.event = nlh->nlmsg_type;