linux-kernel - Re: [PATCH net v3] net: cxgb4/ch_ipsec: fix potential use-after-free in ch_ipsec_xfrm_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <efd3bfa7-d336-4a55-a185-055174e9b4e0@intel.com>
Date: Wed, 15 Oct 2025 11:07:32 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>, Paolo Abeni
	<pabeni@...hat.com>
CC: Zhu Yanjun <yanjun.zhu@...ux.dev>, Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Leon Romanovsky <leon@...nel.org>, "Steffen
 Klassert" <steffen.klassert@...unet.com>, Cosmin Ratiu <cratiu@...dia.com>,
	Ayush Sawal <ayush.sawal@...lsio.com>, Harsh Jain <harsh@...lsio.com>, "Atul
 Gupta" <atul.gupta@...lsio.com>, Herbert Xu <herbert@...dor.apana.org.au>,
	Ganesh Goudar <ganeshgr@...lsio.com>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: Re: [PATCH net v3] net: cxgb4/ch_ipsec: fix potential use-after-free
 in ch_ipsec_xfrm_add_state() callback



On 10/13/2025 2:58 AM, Pavel Zhigulin wrote:
> In ch_ipsec_xfrm_add_state() there is not check of try_module_get
> return value. It is very unlikely, but try_module_get() could return
> false value, which could cause use-after-free error.
> Conditions: The module count must be zero, and a module unload in
> progress. The thread doing the unload is blocked somewhere.
> Another thread makes a callback into the module for some request
> that (for instance) would need to create a kernel thread.
> It tries to get a reference for the thread.
> So try_module_get(THIS_MODULE) is the right call - and will fail here.
> 
> This fix adds checking the result of try_module_get call
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 6dad4e8ab3ec ("chcr: Add support for Inline IPSec")
> Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@...persky.com>
> ---

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>


Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)