Commit
3bc07321ccc236f693ce1b6a8786f0a2e38bb87e
Exists in
master
and in
39 other branches
8mp-imx_5.4.70_2.3.0, 8qm-imx_5.4.70_2.3.0, emb_imx_lf-5.15.y, emb_lf-6.1.y, imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, imx_4.1.15_1.0.0_ga, pitx_8mp_lf-5.10.y, rt-smarc-imx_4.1.15_1.0.0_ga, rt_linux_5.15.71, smarc-8m-android-11.0.0_2.0.0, smarc-imx6_4.14.98_2.0.0_ga, smarc-imx6_4.9.88_2.0.0_ga, smarc-imx7_4.14.98_2.0.0_ga, smarc-imx7_4.9.11_1.0.0_ga, smarc-imx7_4.9.88_2.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-imx_4.1.15_1.0.0_ga, smarc-imx_4.9.11_1.0.0_ga, smarc-imx_4.9.51_imx8m_ga, smarc-imx_4.9.88_2.0.0_ga, smarc-m6.0.1_2.1.0-ga, smarc-n7.1.2_2.0.0-ga, smarc-rel_imx_4.1.15_1.2.0_ga, smarc_8m_00d0_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.14.78_1.0.0_ga, smarc_8m_imx_4.14.98_2.0.0_ga, smarc_8m_imx_4.19.35_1.1.0, smarc_8mm_imx_4.14.78_1.0.0_ga, smarc_8mm_imx_4.14.98_2.0.0_ga, smarc_8mm_imx_4.19.35_1.1.0, smarc_8mm_imx_5.4.24_2.1.0, smarc_8mp_lf-5.10.y, smarc_8mq_imx_5.4.24_2.1.0, smarc_8mq_lf-5.10.y, smarc_imx_lf-5.15.y
xfrm: Force a dst refcount before entering the xfrm type handlers
Crypto requests might return asynchronous. In this case we leave
the rcu protected region, so force a refcount on the skb's
destination entry before we enter the xfrm type input/output
handlers.
This fixes a crash when a route is deleted whilst sending IPsec
data that is transformed by an asynchronous algorithm.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Showing
2 changed files
with
4 additions
and
0 deletions
Side-by-side Diff
... |
... |
@@ -190,6 +190,8 @@ |
190
|
190 |
XFRM_SKB_CB(skb)->seq.input.low = seq; |
191
|
191 |
XFRM_SKB_CB(skb)->seq.input.hi = seq_hi; |
192
|
192 |
|
|
193 |
+ skb_dst_force(skb); |
|
194 |
+ |
193
|
195 |
nexthdr = x->type->input(x, skb); |
194
|
196 |
|
195
|
197 |
if (nexthdr == -EINPROGRESS) |
... |
... |
@@ -78,6 +78,8 @@ |
78
|
78 |
|
79
|
79 |
spin_unlock_bh(&x->lock); |
80
|
80 |
|
|
81 |
+ skb_dst_force(skb); |
|
82 |
+ |
81
|
83 |
err = x->type->output(x, skb); |
82
|
84 |
if (err == -EINPROGRESS) |
83
|
85 |
goto out_exit; |