From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steffen Klassert Subject: Re: [PATCH net v2] xfrm: Fix crash observed during device unregistration and decryption Date: Wed, 23 Mar 2016 13:50:48 +0100 Message-ID: <20160323125048.GC3347@gauss.secunet.com> References: <001c01d1849b$1c7c98e0$5575caa0$@codeaurora.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Cc: , 'Herbert Xu' , To: Subash Abhinov Kasiviswanathan , David Miller Return-path: Received: from a.mx.secunet.com ([62.96.220.36]:41182 "EHLO a.mx.secunet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932306AbcCWMu5 (ORCPT ); Wed, 23 Mar 2016 08:50:57 -0400 Content-Disposition: inline In-Reply-To: <001c01d1849b$1c7c98e0$5575caa0$@codeaurora.org> Sender: netdev-owner@vger.kernel.org List-ID: On Tue, Mar 22, 2016 at 06:29:48PM -0600, Subash Abhinov Kasiviswanathan wrote: > A crash is observed when a decrypted packet is processed in receive > path. get_rps_cpus() tries to dereference the skb->dev fields but it > appears that the device is freed from the poison pattern. > > [] get_rps_cpu+0x94/0x2f0 > [] netif_rx_internal+0x140/0x1cc > [] netif_rx+0x74/0x94 > [] xfrm_input+0x754/0x7d0 > [] xfrm_input_resume+0x10/0x1c > [] esp_input_done+0x20/0x30 > [] process_one_work+0x244/0x3fc > [] worker_thread+0x2f8/0x418 > [] kthread+0xe0/0xec > > -013|get_rps_cpu( > | dev = 0xFFFFFFC08B688000, > | skb = 0xFFFFFFC0C76AAC00 -> ( > | dev = 0xFFFFFFC08B688000 -> ( > | name = > "...................................................... > | name_hlist = (next = 0xAAAAAAAAAAAAAAAA, pprev = > 0xAAAAAAAAAAA > > Following are the sequence of events observed - > > - Encrypted packet in receive path from netdevice is queued > - Encrypted packet queued for decryption (asynchronous) > - Netdevice brought down and freed > - Packet is decrypted and returned through callback in esp_input_done > - Packet is queued again for process in network stack using netif_rx > > Since the device appears to have been freed, the dereference of > skb->dev in get_rps_cpus() leads to an unhandled page fault > exception. > > Fix this by holding on to device reference when queueing packets > asynchronously and releasing the reference on call back return. > > v2: Make the change generic to xfrm as mentioned by Steffen and > update the title to xfrm > > Suggested-by: Herbert Xu > Signed-off-by: Jerome Stanislaus > Signed-off-by: Subash Abhinov Kasiviswanathan Looks good. David, in case you want to take it directly into the net tree: Acked-by: Steffen Klassert