From patchwork Fri Jul 29 07:57:32 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tobias Brunner X-Patchwork-Id: 654026 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3s11Z31VNhz9t0G for ; Fri, 29 Jul 2016 18:08:11 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752366AbcG2IH7 (ORCPT ); Fri, 29 Jul 2016 04:07:59 -0400 Received: from sitav-80046.hsr.ch ([152.96.80.46]:49686 "EHLO mail.strongswan.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752192AbcG2IHc (ORCPT ); Fri, 29 Jul 2016 04:07:32 -0400 X-Greylist: delayed 591 seconds by postgrey-1.27 at vger.kernel.org; Fri, 29 Jul 2016 04:07:31 EDT Received: from [192.168.2.100] (pub082136097193.dh-hfc.datazug.ch [82.136.97.193]) by mail.strongswan.org (Postfix) with ESMTPSA id 21C7840138; Fri, 29 Jul 2016 09:57:43 +0200 (CEST) To: Steffen Klassert , "David S. Miller" Cc: netdev@vger.kernel.org, Herbert Xu , Christophe Gouault From: Tobias Brunner Subject: [PATCH ipsec] xfrm: Ignore socket policies when rebuilding hash tables Message-ID: <8e6b1395-6f17-66ce-e257-6b6073ca7103@strongswan.org> Date: Fri, 29 Jul 2016 09:57:32 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Whenever thresholds are changed the hash tables are rebuilt. This is done by enumerating all policies and hashing and inserting them into the right table according to the thresholds and direction. Because socket policies are also contained in net->xfrm.policy_all but no hash tables are defined for their direction (dir + XFRM_POLICY_MAX) this causes a NULL or invalid pointer dereference after returning from policy_hash_bysel() if the rebuild is done while any socket policies are installed. Since the rebuild after changing thresholds is scheduled this crash could even occur if the userland sets thresholds seemingly before installing any socket policies. Fixes: 53c2e285f970 ("xfrm: Do not hash socket policies") Signed-off-by: Tobias Brunner Acked-by: Herbert Xu --- net/xfrm/xfrm_policy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index b5e665b3cfb0..45f9cf97ea25 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -626,6 +626,10 @@ static void xfrm_hash_rebuild(struct work_struct *work) /* re-insert all policies by order of creation */ list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) { + if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) { + /* skip socket policies */ + continue; + } newpos = NULL; chain = policy_hash_bysel(net, &policy->selector, policy->family,