[PATCH ipsec v4 5/9] xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()
flat view
COOLING4d
From: Antony Antony <hidden>
Date: 2026-10-06 07:06:07
Also in:
linux-doc, lkml
Subsystem:
networking [general], networking [ipsec], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Steffen Klassert, Herbert Xu, Linus Torvalds
Revision v4 of 4 in this series.
Revisions (4)
- v2 [diff vs current]
- v3 [diff vs current]
- v4 current
- v5 [diff vs current]
A concurrent delete can free the migrated state before
xfrm_do_migrate_state() finishes using it.
Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Antony Antony <redacted>
---
net/xfrm/xfrm_user.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5a9f729b4fcb..8640838dcda0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c@@ -3509,6 +3509,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, __xfrm_state_delete(x); spin_unlock_bh(&x->lock); + xfrm_state_hold(xc); err = xfrm_state_migrate_install(x, xc, &m, extack); if (err < 0) { /*
@@ -3516,6 +3517,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, * free under xfrm_cfg_mutex. Both SAs are gone if it does; * restoring x would risk SN/IV reuse. */ + xfrm_state_put(xc); goto out; }
@@ -3534,6 +3536,7 @@ static int xfrm_do_migrate_state(struct sk_buff *skb, struct nlmsghdr *nlh, err = 0; } + xfrm_state_put(xc); out: xfrm_state_put(x); return err;
--
2.47.3