xfrm: move xfrm_garbage_collect out of xfrm_policy_flush
authorHangbin Liu <liuhangbin@gmail.com>
Sun, 11 Jun 2017 01:44:20 +0000 (09:44 +0800)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 12 Jun 2017 09:51:21 +0000 (11:51 +0200)
commit138437f591dd9a42d53c6fed1a3c85e02678851c
treeb2ab938ab6fb1958f50067f1252968af9ef88162
parentb81f884a547b5c264c13fdfaa3b65cf994bf1dcf
xfrm: move xfrm_garbage_collect out of xfrm_policy_flush

Now we will force to do garbage collection if any policy removed in
xfrm_policy_flush(). But during xfrm_net_exit(). We call flow_cache_fini()
first and set set fc->percpu to NULL. Then after we call xfrm_policy_fini()
-> frxm_policy_flush() -> flow_cache_flush(), we will get NULL pointer
dereference when check percpu_empty. The code path looks like:

flow_cache_fini()
  - fc->percpu = NULL
xfrm_policy_fini()
  - xfrm_policy_flush()
    - xfrm_garbage_collect()
      - flow_cache_flush()
        - flow_cache_percpu_empty()
  - fcp = per_cpu_ptr(fc->percpu, cpu)

To reproduce, just add ipsec in netns and then remove the netns.

v2:
As Xin Long suggested, since only two other places need to call it. move
xfrm_garbage_collect() outside xfrm_policy_flush().

v3:
Fix subject mismatch after v2 fix.

Fixes: 35db06912189 ("xfrm: do the garbage collection after flushing policy")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/key/af_key.c
net/xfrm/xfrm_policy.c
net/xfrm/xfrm_user.c