| From 8de3d2a20921e547ff7f87a3593fcbbf99f42cb7 Mon Sep 17 00:00:00 2001 |
| From: Su Yanjun <suyj.fnst@cn.fujitsu.com> |
| Date: Thu, 14 Mar 2019 14:59:42 +0800 |
| Subject: xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module |
| |
| [ Upstream commit 6ee02a54ef990a71bf542b6f0a4e3321de9d9c66 ] |
| |
| When unloading xfrm6_tunnel module, xfrm6_tunnel_fini directly |
| frees the xfrm6_tunnel_spi_kmem. Maybe someone has gotten the |
| xfrm6_tunnel_spi, so need to wait it. |
| |
| Fixes: 91cc3bb0b04ff("xfrm6_tunnel: RCU conversion") |
| Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com> |
| Acked-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ipv6/xfrm6_tunnel.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c |
| index 3a2701d42f471..07b7b2540579c 100644 |
| --- a/net/ipv6/xfrm6_tunnel.c |
| +++ b/net/ipv6/xfrm6_tunnel.c |
| @@ -391,6 +391,10 @@ static void __exit xfrm6_tunnel_fini(void) |
| xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6); |
| xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6); |
| unregister_pernet_subsys(&xfrm6_tunnel_net_ops); |
| + /* Someone maybe has gotten the xfrm6_tunnel_spi. |
| + * So need to wait it. |
| + */ |
| + rcu_barrier(); |
| kmem_cache_destroy(xfrm6_tunnel_spi_kmem); |
| } |
| |
| -- |
| 2.20.1 |
| |
