diff options
| author | Su Yanjun | 2019-03-14 07:59:42 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2019-05-25 18:23:40 +0200 |
| commit | 64f214ce563f3ab01bee7cce2ca5fad95bea094a (patch) | |
| tree | d5ea9c7cf1d3b4a15cfe3cc3e02b42c6372dbdd9 /net/ipv6 | |
| parent | xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink (diff) | |
| download | kernel-qcow2-linux-64f214ce563f3ab01bee7cce2ca5fad95bea094a.tar.gz kernel-qcow2-linux-64f214ce563f3ab01bee7cce2ca5fad95bea094a.tar.xz kernel-qcow2-linux-64f214ce563f3ab01bee7cce2ca5fad95bea094a.zip | |
xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
[ Upstream commit 6ee02a54ef990a71bf542b6f0a4e3321de9d9c66 ]
When unloading xfrm6_tunnel module, xfrm6_tunnel_fini directly
frees the xfrm6_tunnel_spi_kmem. Maybe someone has gotten the
xfrm6_tunnel_spi, so need to wait it.
Fixes: 91cc3bb0b04ff("xfrm6_tunnel: RCU conversion")
Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/xfrm6_tunnel.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c index bc65db782bfb..12cb3aa990af 100644 --- a/net/ipv6/xfrm6_tunnel.c +++ b/net/ipv6/xfrm6_tunnel.c @@ -402,6 +402,10 @@ static void __exit xfrm6_tunnel_fini(void) xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); unregister_pernet_subsys(&xfrm6_tunnel_net_ops); + /* Someone maybe has gotten the xfrm6_tunnel_spi. + * So need to wait it. + */ + rcu_barrier(); kmem_cache_destroy(xfrm6_tunnel_spi_kmem); } |