[PATCH ipsec v2 2/6] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
From: Antony Antony <hidden>
Date: 2026-09-08 06:49:30
Also in:
linux-doc, linux-kselftest
Subsystem:
networking [general], networking [ipsec], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, Linus Torvalds
A concurrent delete can free the migrated state before
xfrm_do_migrate_state() finishes using it.
Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Antony Antony <redacted>
---
net/xfrm/xfrm_user.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index fffce22389e8..48b8a0af95e2 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c@@ -3479,6 +3479,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, __xfrm_state_delete(x); spin_unlock_bh(&x->lock); + xfrm_state_hold(xc); err = xfrm_state_migrate_install(x, xc, &m, extack); if (err < 0) { /*
@@ -3486,6 +3487,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, * free under xfrm_cfg_mutex. Both SAs are gone if it does; * restoring x would risk SN/IV reuse. */ + xfrm_state_put(xc); goto out; }
@@ -3504,6 +3506,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, err = 0; } + xfrm_state_put(xc); out: xfrm_state_put(x); return err;
--
2.47.3