releases/4.4.181/xfrm6_tunnel-fix-potential-panic-when-unloading-xfrm.patch

   1 From fe62e481297878a35494219232c66d7b0e58cecb Mon Sep 17 00:00:00 2001
   2 From: Su Yanjun <suyj.fnst@cn.fujitsu.com>
   3 Date: Thu, 14 Mar 2019 14:59:42 +0800
   4 Subject: xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
   5
   6 [ Upstream commit 6ee02a54ef990a71bf542b6f0a4e3321de9d9c66 ]
   7
   8 When unloading xfrm6_tunnel module, xfrm6_tunnel_fini directly
   9 frees the xfrm6_tunnel_spi_kmem. Maybe someone has gotten the
  10 xfrm6_tunnel_spi, so need to wait it.
  11
  12 Fixes: 91cc3bb0b04ff("xfrm6_tunnel: RCU conversion")
  13 Signed-off-by: Su Yanjun <suyj.fnst@cn.fujitsu.com>
  14 Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
  15 Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  16 Signed-off-by: Sasha Levin <sashal@kernel.org>
  17 ---
  18  net/ipv6/xfrm6_tunnel.c |    4 ++++
  19  1 file changed, 4 insertions(+)
  20
  21 --- a/net/ipv6/xfrm6_tunnel.c
  22 +++ b/net/ipv6/xfrm6_tunnel.c
  23 @@ -391,6 +391,10 @@ static void __exit xfrm6_tunnel_fini(voi
  24         xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
  25         xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
  26         unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
  27 +       /* Someone maybe has gotten the xfrm6_tunnel_spi.
  28 +        * So need to wait it.
  29 +        */
  30 +       rcu_barrier();
  31         kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
  32  }
  33