Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Date:   Mon, 25 Sep 2023 07:41:24 +0200
From:   Steffen Klassert <steffen.klassert@secunet.com>
To:     Zhang Changzhong <zhangchangzhong@huawei.com>
CC:     Herbert Xu <herbert@gondor.apana.org.au>,
        "David S. Miller" <davem@davemloft.net>,
        David Ahern <dsahern@kernel.org>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Xin Long <lucien.xin@gmail.com>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH net] xfrm6: fix inet6_dev refcount underflow problem
Message-ID: <ZREdhN1hl6+6Eic2@gauss3.secunet.de>
References: <1694776841-30837-1-git-send-email-zhangchangzhong@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <1694776841-30837-1-git-send-email-zhangchangzhong@huawei.com>
Precedence: bulk

On Fri, Sep 15, 2023 at 07:20:41PM +0800, Zhang Changzhong wrote:
> There are race conditions that may lead to inet6_dev refcount underflow
> in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev().
> 
> One of the refcount underflow bugs is shown below:
> 	(cpu 1)                	|	(cpu 2)
> xfrm6_dst_destroy()             |
>   ...                           |
>   in6_dev_put()                 |
> 				|  rt6_uncached_list_flush_dev()
>   ...				|    ...
> 				|    in6_dev_put()
>   rt6_uncached_list_del()       |    ...
>   ...                           |
> 
> xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(),
> so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put()
> again for the same inet6_dev.
> 
> Fix it by moving in6_dev_put() after rt6_uncached_list_del() in
> xfrm6_dst_destroy().
> 
> Fixes: 510c321b5571 ("xfrm: reuse uncached_list to track xdsts")
> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

Applied, thanks a lot!