[PATCH net] xfrm: delete migrated old states before dropping their references

[Jun Yang <juny24602@gmail.com>]

From: Jun Yang <junvyyang@tencent.com>

xfrm_migrate_state_find() returns a referenced old state, but
xfrm_migrate() drops the references in x_cur[] before deleting those
states. If an expiry timer or another concurrent deletion has already
removed a state from the table, the put can release its last reference,
leaving xfrm_state_delete() to access a freed state.

Delete the old states before dropping their lookup references, so they
remain alive throughout xfrm_states_delete().

Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Cc: stable@kernel.org
Reported-by: TencentOS Corvus AI <corvus@tencent.com>
Signed-off-by: Jun Yang <junvyyang@tencent.com>
---
A KASAN reproducer for this issue is available if requested.

 net/xfrm/xfrm_policy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9ea60c7717ff..5d818c1ec9e4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -4722,8 +4722,8 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
 
 	/* Stage 4 - delete old state(s) */
 	if (nx_cur) {
-		xfrm_states_put(x_cur, nx_cur);
 		xfrm_states_delete(x_cur, nx_cur);
+		xfrm_states_put(x_cur, nx_cur);
 	}
 
 	/* Stage 5 - announce */
-- 
2.43.7