netdev - Re: [PATCH ipsec] xfrm: don't call xfrm_policy_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 9 Jan 2018 13:00:48 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Florian Westphal <fw@...len.de>
CC:     <netdev@...r.kernel.org>
Subject: Re: [PATCH ipsec] xfrm: don't call xfrm_policy_cache_flush while
 holding spinlock

On Sat, Jan 06, 2018 at 01:13:08AM +0100, Florian Westphal wrote:
> xfrm_policy_cache_flush can sleep, so it cannot be called while holding
> a spinlock.  We could release the lock first, but I don't see why we need
> to invoke this function here in first place, the packet path won't reuse
> an xdst entry unless its still valid.
> 
> While at it, add an annotation to xfrm_policy_cache_flush, it would
> have probably caught this bug sooner.
> 
> Fixes: ec30d78c14a813 ("xfrm: add xdst pcpu cache")
> Reported-by: syzbot+e149f7d1328c26f9c12f@...kaller.appspotmail.com
> Signed-off-by: Florian Westphal <fw@...len.de>

Applied, thanks a lot!