[PATCH net 1/2] vti: fix tunnel device use-after-free across async crypto resumption
flat view
HOTtoday
From: Qihang <hidden>
Date: 2026-09-30 09:08:30
Subsystem:
networking [general], networking [ipsec], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, David Ahern, Ido Schimmel, Linus Torvalds
vti_input() caches the tunnel pointer in the skb control buffer
without taking a device reference. With async crypto, vti_rcv_cb()
runs from the crypto completion, after a possible device teardown, and
dereferences the freed tunnel device. The rcu_read_lock() around the
callback cannot protect it, as the pointer was cached before the
deletion grace period.
Take a device reference while the pointer is cached and drop it in
vti_rcv_cb() after the last use. An RTM_DELLINK on a VTI device with
pending async crypto now waits for the completion.
Fixes: df3893c176e9 ("vti: Update the ipv4 side to use it's own receive hook.")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <redacted>
---
net/ipv4/ip_vti.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 3b80929994a0..9f44666139f8 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c@@ -63,6 +63,8 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi, XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel; + dev_hold(tunnel->dev); + if (update_skb_dev) skb->dev = tunnel->dev;
@@ -109,10 +111,14 @@ static int vti_rcv_cb(struct sk_buff *skb, int err) dev = tunnel->dev; + /* Drop the reference taken in vti_input(). -EINVAL/-EPERM make + * xfrm_input() re-invoke us with err = -1 and drop it then. + */ if (err) { DEV_STATS_INC(dev, rx_errors); DEV_STATS_INC(dev, rx_dropped); + dev_put(dev); return 0; }
@@ -141,6 +147,7 @@ static int vti_rcv_cb(struct sk_buff *skb, int err) skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev))); skb->dev = dev; dev_sw_netstats_rx_add(dev, skb->len); + dev_put(dev); return 0; }
--
2.54.0 (Apple Git-157)