• Xiaodong Xu's avatar
    xfrm: release device reference for invalid state · 4944a4b1
    Xiaodong Xu authored
    An ESP packet could be decrypted in async mode if the input handler for
    this packet returns -EINPROGRESS in xfrm_input(). At this moment the device
    reference in skb is held. Later xfrm_input() will be invoked again to
    resume the processing.
    If the transform state is still valid it would continue to release the
    device reference and there won't be a problem; however if the transform
    state is not valid when async resumption happens, the packet will be
    dropped while the device reference is still being held.
    When the device is deleted for some reason and the reference to this
    device is not properly released, the kernel will keep logging like:
    
    unregister_netdevice: waiting for ppp2 to become free. Usage count = 1
    
    The issue is observed when running IPsec traffic over a PPPoE device based
    on a bridge interface. By terminating the PPPoE connection on the server
    end for multiple times, the PPPoE device on the client side will eventually
    get stuck on the above warning message.
    
    This patch will check the async mode first and continue to release device
    reference in async resumption, before it is dropped due to invalid state.
    
    v2: Do not assign address family from outer_mode in the transform if the
    state is invalid
    
    v3: Release device reference in the error path instead of jumping to resume
    
    Fixes: 4ce3dbe3 ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)")
    Signed-off-by: default avatarXiaodong Xu <stid.smth@gmail.com>
    Reported-by: default avatarBo Chen <chenborfc@163.com>
    Tested-by: default avatarBo Chen <chenborfc@163.com>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    4944a4b1
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
xfrm_algo.c Loading commit data...
xfrm_device.c Loading commit data...
xfrm_hash.c Loading commit data...
xfrm_hash.h Loading commit data...
xfrm_inout.h Loading commit data...
xfrm_input.c Loading commit data...
xfrm_interface.c Loading commit data...
xfrm_ipcomp.c Loading commit data...
xfrm_output.c Loading commit data...
xfrm_policy.c Loading commit data...
xfrm_proc.c Loading commit data...
xfrm_replay.c Loading commit data...
xfrm_state.c Loading commit data...
xfrm_sysctl.c Loading commit data...
xfrm_user.c Loading commit data...