[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251006110317.39d08275@kernel.org>
Date: Mon, 6 Oct 2025 11:03:17 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Zhu Yanjun <yanjun.zhu@...ux.dev>
Cc: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>, Ayush Sawal
<ayush.sawal@...lsio.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David S.
Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Paolo
Abeni <pabeni@...hat.com>, Leon Romanovsky <leon@...nel.org>, Steffen
Klassert <steffen.klassert@...unet.com>, Cosmin Ratiu <cratiu@...dia.com>,
Harsh Jain <harsh@...lsio.com>, Atul Gupta <atul.gupta@...lsio.com>,
Herbert Xu <herbert@...dor.apana.org.au>, Ganesh Goudar
<ganeshgr@...lsio.com>, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org
Subject: Re: [PATCH] net: fix potential use-after-free in
ch_ipsec_xfrm_add_state() callback
On Fri, 3 Oct 2025 21:28:51 -0700 Zhu Yanjun wrote:
> When the function ch_ipsec_xfrm_add_state is called, the kernel module
> cannot be in the GOING or UNFORMED state.
That was my intuition as well, but on a quick look module state is set
to GOING before ->exit() is called. So this function can in fact fail
to acquire a reference.
Could you share your exact analysis?
Powered by blists - more mailing lists