[PATCH net 0/2] vti: fix tunnel device use-after-free across async crypto resumption

[Qihang <q.h.hack.winter@gmail.com>]

vti_input() and vti6_input_proto() cache the tunnel pointer in the skb
control buffer without taking a reference.  With async crypto the
receive callback runs from the crypto completion, so a concurrent
RTM_DELLINK can free the tunnel device before the callback uses the
cached pointer.  The existing rcu_read_lock() around the callback does
not protect it.

Patch 1 fixes the IPv4 side and carries the full description; patch 2
applies the same fix to the IPv6 side.

Qihang (2):
  vti: fix tunnel device use-after-free across async crypto resumption
  vti6: fix tunnel device use-after-free across async crypto resumption

 net/ipv4/ip_vti.c  | 7 +++++++
 net/ipv6/ip6_vti.c | 8 ++++++++
 2 files changed, 15 insertions(+)

-- 
2.54.0 (Apple Git-157)