Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02efdff7 authored by Florian Westphal's avatar Florian Westphal Committed by Steffen Klassert
Browse files

xfrm: state: use atomic_inc_not_zero to increment refcount 



Once xfrm_state_lookup_byaddr no longer acquires the state lock another
cpu might be freeing the state entry at the same time.

To detect this we use atomic_inc_not_zero, we then signal -EAGAIN to
caller in case our result was stale.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent ae3fb6d3

net/xfrm/xfrm_state.c

+16 −5
Original line number Original line Diff line number Diff line
@@ -37,6 +37,11 @@ 




static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;

static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;





static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x)

{

	return atomic_inc_not_zero(&x->refcnt);

}



static inline unsigned int xfrm_dst_hash(struct net *net,

static inline unsigned int xfrm_dst_hash(struct net *net,

					 const xfrm_address_t *daddr,

					 const xfrm_address_t *daddr,

					 const xfrm_address_t *saddr,

					 const xfrm_address_t *saddr,
@@ -668,7 +673,8 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, u32 mark, 




		if ((mark & x->mark.m) != x->mark.v)

		if ((mark & x->mark.m) != x->mark.v)

			continue;

			continue;

		xfrm_state_hold(x);

		if (!xfrm_state_hold_rcu(x))

			continue;

		return x;

		return x;

	}

	}
@@ -692,7 +698,8 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, u32 mark, 




		if ((mark & x->mark.m) != x->mark.v)

		if ((mark & x->mark.m) != x->mark.v)

			continue;

			continue;

		xfrm_state_hold(x);

		if (!xfrm_state_hold_rcu(x))

			continue;

		return x;

		return x;

	}

	}
@@ -871,10 +878,14 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, 
		}

		}

	}

	}

out:

out:

	if (x)

	if (x) {

		xfrm_state_hold(x);

		if (!xfrm_state_hold_rcu(x)) {

	else

			*err = -EAGAIN;

			x = NULL;

		}

	} else {

		*err = acquire_in_progress ? -EAGAIN : error;

		*err = acquire_in_progress ? -EAGAIN : error;

	}

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	spin_unlock_bh(&net->xfrm.xfrm_state_lock);

	if (to_put)

	if (to_put)

		xfrm_state_put(to_put);

		xfrm_state_put(to_put);