xfrm: Update ipcomp_scratches with NULL when freed
stable inclusion from stable-v5.10.150 commit be81c44242b20fc3bdcc73480ef8aaee56f5d0b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0XA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=be81c44242b20fc3bdcc73480ef8aaee56f5d0b6 -------------------------------- [ Upstream commit 8a04d2fc ] Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu scratches using ipcomp_free_scratches() it tries to vfree non existent vm area. Described below: static void * __percpu *ipcomp_alloc_scratches(void) { ... scratches = alloc_percpu(void *); if (!scratches) return NULL; ipcomp_scratches does not know about this allocation failure. Therefore holding the old obsolete address. ... } So when we free, static void ipcomp_free_scratches(void) { ... scratches = ipcomp_scratches; Assigning obsolete address from ipcomp_scratches if (!scratches) return; for_each_possible_cpu(i) vfree(*per_cpu_ptr(scratches, i)); Trying to free non existent page, causing warning: trying to vfree existent vm area. ... } Fix this breakage by updating ipcomp_scrtches with NULL when scratches is freed Suggested-by:Herbert Xu <herbert@gondor.apana.org.au> Reported-by:
<syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com> Tested-by:
<syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com> Signed-off-by:
Khalid Masum <khalid.masum.92@gmail.com> Acked-by:
Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by:
Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
Jialin Zhang <zhangjialin11@huawei.com>
Loading
Please sign in to comment