diff options
| author | Li RongQing <roy.qing.li@gmail.com> | 2015-04-28 20:42:44 -0400 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2015-04-29 07:53:46 -0400 |
| commit | bdddbf6996c0b9299efc97b8f66e06286f3aa8c9 (patch) | |
| tree | 504d61ae096e3b3e4272b877638b49db2d33da22 | |
| parent | 39376ccb1968ba9f83e2a880a8bf02ad5dea44e1 (diff) | |
xfrm: fix a race in xfrm_state_lookup_byspi
The returned xfrm_state should be hold before unlock xfrm_state_lock,
otherwise the returned xfrm_state maybe be released.
Fixes: c454997e6[{pktgen, xfrm} Introduce xfrm_state_lookup_byspi..]
Cc: Fan Du <fan.du@intel.com>
Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Acked-by: Fan Du <fan.du@intel.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
| -rw-r--r-- | net/xfrm/xfrm_state.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index f5e39e35d73a..96688cd0f6f1 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c | |||
| @@ -927,8 +927,8 @@ struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi, | |||
| 927 | x->id.spi != spi) | 927 | x->id.spi != spi) |
| 928 | continue; | 928 | continue; |
| 929 | 929 | ||
| 930 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); | ||
| 931 | xfrm_state_hold(x); | 930 | xfrm_state_hold(x); |
| 931 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); | ||
| 932 | return x; | 932 | return x; |
| 933 | } | 933 | } |
| 934 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); | 934 | spin_unlock_bh(&net->xfrm.xfrm_state_lock); |