From: Michal Kubecek Date: Tue, 3 Jun 2014 08:26:06 +0000 (+0200) Subject: xfrm: fix race between netns cleanup and state expire notification X-Git-Tag: omap-for-v3.16/fixes-against-rc1~36^2~78^2~6 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=21ee543edc0dea36ab58d24523fcd42b8a270df8;p=pandora-kernel.git xfrm: fix race between netns cleanup and state expire notification The xfrm_user module registers its pernet init/exit after xfrm itself so that its net exit function xfrm_user_net_exit() is executed before xfrm_net_exit() which calls xfrm_state_fini() to cleanup the SA's (xfrm states). This opens a window between zeroing net->xfrm.nlsk pointer and deleting all xfrm_state instances which may access it (via the timer). If an xfrm state expires in this window, xfrm_exp_state_notify() will pass null pointer as socket to nlmsg_multicast(). As the notifications are called inside rcu_read_lock() block, it is sufficient to retrieve the nlsk socket with rcu_dereference() and check the it for null. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller --- Reading git-diff-tree failed