| From fe62e481297878a35494219232c66d7b0e58cecb Mon Sep 17 00:00:00 2001 |
| From: Su Yanjun <suyj.fnst@cn.fujitsu.com> |
| Date: Thu, 14 Mar 2019 14:59:42 +0800 |
| Subject: xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module |
| |
| [ Upstream commit 6ee02a54ef990a71bf542b6f0a4e3321de9d9c66 ] |
| |
| When unloading xfrm6_tunnel module, xfrm6_tunnel_fini directly |
| frees the xfrm6_tunnel_spi_kmem. Maybe someone has gotten the |
| xfrm6_tunnel_spi, so need to wait it. |
| |
| Fixes: 91cc3bb0b04ff("xfrm6_tunnel: RCU conversion") |
| Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com> |
| Acked-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ipv6/xfrm6_tunnel.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/net/ipv6/xfrm6_tunnel.c |
| +++ b/net/ipv6/xfrm6_tunnel.c |
| @@ -391,6 +391,10 @@ static void __exit xfrm6_tunnel_fini(voi |
| xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); |
| xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); |
| unregister_pernet_subsys(&xfrm6_tunnel_net_ops); |
| + /* Someone maybe has gotten the xfrm6_tunnel_spi. |
| + * So need to wait it. |
| + */ |
| + rcu_barrier(); |
| kmem_cache_destroy(xfrm6_tunnel_spi_kmem); |
| } |
| |
