Commit 4bda4f25 authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by David S. Miller
Browse files

[XFRM]: Fix potential race vs xfrm_state(only)_find and xfrm_hash_resize. 



The _find calls calculate the hash value using the
xfrm_state_hmask, without the xfrm_state_lock. But the
value of this mask can change in the _resize call under
the state_lock, so we risk to fail in finding the desired
entry in hash.

I think, that the hash value is better to calculate
under the state lock.

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5e41fb83

net/xfrm/xfrm_state.c

+4 −2
Original line number Diff line number Diff line
@@ -756,7 +756,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
		struct xfrm_policy *pol, int *err,

		unsigned short family)

{

	unsigned int h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);

	unsigned int h;

	struct hlist_node *entry;

	struct xfrm_state *x, *x0;

	int acquire_in_progress = 0;
@@ -764,6 +764,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
	struct xfrm_state *best = NULL;



	spin_lock_bh(&xfrm_state_lock);

	h = xfrm_dst_hash(daddr, saddr, tmpl->reqid, family);

	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {

		if (x->props.family == family &&

		    x->props.reqid == tmpl->reqid &&
@@ -865,11 +866,12 @@ struct xfrm_state * 
xfrm_stateonly_find(xfrm_address_t *daddr, xfrm_address_t *saddr,

		    unsigned short family, u8 mode, u8 proto, u32 reqid)

{

	unsigned int h = xfrm_dst_hash(daddr, saddr, reqid, family);

	unsigned int h;

	struct xfrm_state *rx = NULL, *x = NULL;

	struct hlist_node *entry;



	spin_lock(&xfrm_state_lock);

	h = xfrm_dst_hash(daddr, saddr, reqid, family);

	hlist_for_each_entry(x, entry, xfrm_state_bydst+h, bydst) {

		if (x->props.family == family &&

		    x->props.reqid == reqid &&

CRA Git | Maintained and supported by SUSTech CRA and CCSE