diff options
| author | Li RongQing <roy.qing.li@gmail.com> | 2015-04-29 02:42:44 +0200 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2015-04-29 13:53:46 +0200 |
| commit | bdddbf6996c0b9299efc97b8f66e06286f3aa8c9 (patch) | |
| tree | 504d61ae096e3b3e4272b877638b49db2d33da22 /net/xfrm | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf (diff) | |
| download | linux-bdddbf6996c0b9299efc97b8f66e06286f3aa8c9.tar.xz linux-bdddbf6996c0b9299efc97b8f66e06286f3aa8c9.zip | |
xfrm: fix a race in xfrm_state_lookup_byspi
The returned xfrm_state should be hold before unlock xfrm_state_lock,
otherwise the returned xfrm_state maybe be released.
Fixes: c454997e6[{pktgen, xfrm} Introduce xfrm_state_lookup_byspi..]
Cc: Fan Du <fan.du@intel.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Fan Du <fan.du@intel.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm')
| -rw-r--r-- | net/xfrm/xfrm_state.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index f5e39e35d73a..96688cd0f6f1 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -927,8 +927,8 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, x->id.spi != spi) continue; - spin_unlock_bh(&net->xfrm.xfrm_state_lock); xfrm_state_hold(x); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); return x; } spin_unlock_bh(&net->xfrm.xfrm_state_lock); |