From: Tristan Madani xfrm_state_find() checks x->km.state outside the xfrm_state_lock before inserting the state into the policy output state cache. Between the check and the lock acquisition, __xfrm_state_delete() can transition the state to XFRM_STATE_DEAD. The dead state is then inserted into the cache because the stale validity result is trusted after the lock is acquired. A subsequent call traversing the cache can then access a freed state, since xfrm_state_gc_destroy() does not unlink from state_cache_list. This is the output state cache counterpart of the input cache race fixed by commit ddd3d01329203 ("xfrm: Fix xfrm state cache insertion race"). Apply the same pattern: move the km.state validity check inside the lock so the check and the insertion are atomic with respect to __xfrm_state_delete(). Fixes: 0045e3d80613 ("xfrm: Cache used outbound xfrm states at the policy.") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- net/xfrm/xfrm_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index e45aa1ed5b965..03baa50f0df7c 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1632,10 +1632,11 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, *err = acquire_in_progress ? -EAGAIN : error; } - if (x && x->km.state == XFRM_STATE_VALID && !cached && + if (x && !cached && (!(pol->flags & XFRM_POLICY_CPU_ACQUIRE) || x->pcpu_num == pcpu_id)) { spin_lock_bh(&net->xfrm.xfrm_state_lock); - if (hlist_unhashed(&x->state_cache)) + if (x->km.state == XFRM_STATE_VALID && + hlist_unhashed(&x->state_cache)) hlist_add_head_rcu(&x->state_cache, &pol->state_cache_list); spin_unlock_bh(&net->xfrm.xfrm_state_lock); } -- 2.47.3