From patchwork Tue Feb 18 08:37:38 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steffen Klassert X-Patchwork-Id: 321315 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 31C972C00AF for ; Tue, 18 Feb 2014 19:37:47 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754614AbaBRIhm (ORCPT ); Tue, 18 Feb 2014 03:37:42 -0500 Received: from a.mx.secunet.com ([195.81.216.161]:47917 "EHLO a.mx.secunet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754212AbaBRIhl (ORCPT ); Tue, 18 Feb 2014 03:37:41 -0500 Received: from localhost (alg1 [127.0.0.1]) by a.mx.secunet.com (Postfix) with ESMTP id ED4DE1A008E; Tue, 18 Feb 2014 09:37:40 +0100 (CET) X-Virus-Scanned: by secunet Received: from a.mx.secunet.com ([127.0.0.1]) by localhost (a.mx.secunet.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id qyaf2Tafh5u6; Tue, 18 Feb 2014 09:37:39 +0100 (CET) Received: from mail-gw-int (unknown [10.53.40.207]) by a.mx.secunet.com (Postfix) with ESMTP id CC7C21A007B; Tue, 18 Feb 2014 09:37:39 +0100 (CET) Received: from [10.53.40.204] (port=13199 helo=mail-essen-01.secunet.de) by mail-gw-int with esmtp (Exim 4.80 #2 (Debian)) id 1WFg5g-0000Ke-1A; Tue, 18 Feb 2014 09:31:44 +0100 Received: from gauss.dd.secunet.de (10.182.7.102) by mail-essen-01.secunet.de (10.53.40.204) with Microsoft SMTP Server id 14.3.174.1; Tue, 18 Feb 2014 09:37:39 +0100 Received: by gauss.dd.secunet.de (Postfix, from userid 1000) id 8A9B95C0C02; Tue, 18 Feb 2014 09:37:38 +0100 (CET) Date: Tue, 18 Feb 2014 09:37:38 +0100 From: Steffen Klassert To: Xianpeng Zhao <673321875@qq.com> CC: netdev , alan Subject: Re: Fw:[Bug 70471] xfrm policy node will double unlink. Message-ID: <20140218083737.GB32371@secunet.com> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Originating-IP: [10.182.7.102] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Tue, Feb 18, 2014 at 10:55:57AM +0800, Xianpeng Zhao wrote: > Hi Group, > I found a problem about xfrm policy. > > In corner case, xfrm policy node will be double unlinked from the list. > > The scenario like this: > In thread context, After removed the node from list, before remove the xfrm policy expire timer. At this point, a timer interrupt come, and call the run_timer_softirq to execute the xfrm_policy_timer to remove the expired policy node; because this policy node had already removed from list. this remove will cause the node double unlinked. Good catch! I wonder why I've never seen this. Do you have a reproducer for this bug? Looks like it is sufficient to reinitialize the bydst hlist in __xfrm_policy_unlink(). Then hlist_unhashed() will notice that this policy is not linked. Does the patch below help? --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 121399d..225f439 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1156,7 +1156,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol, if (hlist_unhashed(&pol->bydst)) return NULL; - hlist_del(&pol->bydst); + hlist_del_init(&pol->bydst); hlist_del(&pol->byidx); list_del(&pol->walk.all); net->xfrm.policy_count[dir]--;