netdev - Re: [PATCH net] net: drop secpath extension before skb deferral free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZlWZYOMaiAUE8a3+@gauss3.secunet.de>
Date: Tue, 28 May 2024 10:44:16 +0200
From: Steffen Klassert <steffen.klassert@...unet.com>
To: Jianbo Liu <jianbol@...dia.com>
CC: Leon Romanovsky <leonro@...dia.com>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"fw@...len.de" <fw@...len.de>
Subject: Re: [PATCH net] net: drop secpath extension before skb deferral free

On Mon, May 27, 2024 at 09:40:23AM +0200, Steffen Klassert wrote:
> On Thu, May 23, 2024 at 03:26:22PM +0000, Jianbo Liu wrote:
> > On Thu, 2024-05-23 at 12:00 +0200, Steffen Klassert wrote:
> > > 
> > > Hm, interesting.
> > > 
> > > Can you check if xfrm_dev_state_free() is triggered in that codepath
> > > and if it actually removes the device from the states?
> > > 
> > 
> > xfrm_dev_state_free is not triggered. I think it's because I did "ip x
> > s delall" before unregister netdev.
> 
> Yes, likely. So we can't defer the device removal to the state free
> functions, we always need to do that on state delete.

The only (not too complicated) solution I see so far is to
free the device early, along with the state delete function:

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 649bb739df0d..bfc71d2daa6a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -721,6 +721,7 @@ int __xfrm_state_delete(struct xfrm_state *x)
 			sock_put(rcu_dereference_raw(x->encap_sk));
 
 		xfrm_dev_state_delete(x);
+		xfrm_dev_state_free(x);
 
 		/* All xfrm_state objects are created by xfrm_state_alloc.
 		 * The xfrm_state_alloc call gives a reference, and that