[PATCH net 1/2] vti: fix tunnel device use-after-free across async crypto resumption

[Qihang <q.h.hack.winter@gmail.com>]

vti_input() caches the tunnel pointer in the skb control buffer
without taking a device reference.  With async crypto, vti_rcv_cb()
runs from the crypto completion, after a possible device teardown, and
dereferences the freed tunnel device.  The rcu_read_lock() around the
callback cannot protect it, as the pointer was cached before the
deletion grace period.

Take a device reference while the pointer is cached and drop it in
vti_rcv_cb() after the last use.  An RTM_DELLINK on a VTI device with
pending async crypto now waits for the completion.

Fixes: df3893c176e9 ("vti: Update the ipv4 side to use it's own receive hook.")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
---
 net/ipv4/ip_vti.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 3b80929994a0..9f44666139f8 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -63,6 +63,8 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
 
 		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
 
+		dev_hold(tunnel->dev);
+
 		if (update_skb_dev)
 			skb->dev = tunnel->dev;
 
@@ -109,10 +111,14 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
 
 	dev = tunnel->dev;
 
+	/* Drop the reference taken in vti_input().  -EINVAL/-EPERM make
+	 * xfrm_input() re-invoke us with err = -1 and drop it then.
+	 */
 	if (err) {
 		DEV_STATS_INC(dev, rx_errors);
 		DEV_STATS_INC(dev, rx_dropped);
 
+		dev_put(dev);
 		return 0;
 	}
 
@@ -141,6 +147,7 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
 	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
 	skb->dev = dev;
 	dev_sw_netstats_rx_add(dev, skb->len);
+	dev_put(dev);
 
 	return 0;
 }
-- 
2.54.0 (Apple Git-157)