From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6FDBC432C0 for ; Fri, 22 Nov 2019 19:49:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 87CC320658 for ; Fri, 22 Nov 2019 19:49:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574452154; bh=TWUIFvYxcxpAcHyaC4L/g1aet1SZVEHMCG8j8roj8dk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Ka/0m7K1t2wubk8j2ix/Oq1K44WwliuDGRL2ej/5NmlU1rbxz3ESyaDJYD/qhizyk StjOOUbb0QXAuD7ZE4g0VL+hP2glsfofHZ1V+MwOrUKYQWByTn8XGn2pGDD57227ox 2soHiTRfJfwcqQgOYYp71xDce0zbGGIVszH4PzPE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727230AbfKVTtN (ORCPT ); Fri, 22 Nov 2019 14:49:13 -0500 Received: from mail.kernel.org ([198.145.29.99]:48240 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727176AbfKVTtJ (ORCPT ); Fri, 22 Nov 2019 14:49:09 -0500 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 015BB2072E; Fri, 22 Nov 2019 19:49:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1574452148; bh=TWUIFvYxcxpAcHyaC4L/g1aet1SZVEHMCG8j8roj8dk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fF23hjvp1tDxYdvXp9cWBQQsSHn0vb54DZx8JPJ4KaNWCr9UvOfXgNHpCw3yU1CF5 w/GLYpBPAQTFzj6H8+SAmQJuq2Ho2n9P2/h+F9XHlF4MUoaSs4rmqiiN7ktyz26fWt CJbs/qICXsUb2hU1Q10Z1mIrdfpg4BMHvfUfDncc= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Xiaodong Xu , Bo Chen , Steffen Klassert , Sasha Levin , netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 08/25] xfrm: release device reference for invalid state Date: Fri, 22 Nov 2019 14:48:41 -0500 Message-Id: <20191122194859.24508-8-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191122194859.24508-1-sashal@kernel.org> References: <20191122194859.24508-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xiaodong Xu [ Upstream commit 4944a4b1077f74d89073624bd286219d2fcbfce3 ] An ESP packet could be decrypted in async mode if the input handler for this packet returns -EINPROGRESS in xfrm_input(). At this moment the device reference in skb is held. Later xfrm_input() will be invoked again to resume the processing. If the transform state is still valid it would continue to release the device reference and there won't be a problem; however if the transform state is not valid when async resumption happens, the packet will be dropped while the device reference is still being held. When the device is deleted for some reason and the reference to this device is not properly released, the kernel will keep logging like: unregister_netdevice: waiting for ppp2 to become free. Usage count = 1 The issue is observed when running IPsec traffic over a PPPoE device based on a bridge interface. By terminating the PPPoE connection on the server end for multiple times, the PPPoE device on the client side will eventually get stuck on the above warning message. This patch will check the async mode first and continue to release device reference in async resumption, before it is dropped due to invalid state. v2: Do not assign address family from outer_mode in the transform if the state is invalid v3: Release device reference in the error path instead of jumping to resume Fixes: 4ce3dbe397d7b ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)") Signed-off-by: Xiaodong Xu Reported-by: Bo Chen Tested-by: Bo Chen Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- net/xfrm/xfrm_input.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 790b514f86b62..b0b1294daef17 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -246,6 +246,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) else XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID); + + if (encap_type == -1) + dev_put(skb->dev); goto drop; } -- 2.20.1