• Khalid Masum's avatar
    xfrm: Update ipcomp_scratches with NULL when freed · 8a04d2fc
    Khalid Masum authored
    Currently if ipcomp_alloc_scratches() fails to allocate memory
    ipcomp_scratches holds obsolete address. So when we try to free the
    percpu scratches using ipcomp_free_scratches() it tries to vfree non
    existent vm area. Described below:
    
    static void * __percpu *ipcomp_alloc_scratches(void)
    {
            ...
            scratches = alloc_percpu(void *);
            if (!scratches)
                    return NULL;
    ipcomp_scratches does not know about this allocation failure.
    Therefore holding the old obsolete address.
            ...
    }
    
    So when we free,
    
    static void ipcomp_free_scratches(void)
    {
            ...
            scratches = ipcomp_scratches;
    Assigning obsolete address from ipcomp_scratches
    
            if (!scratches)
                    return;
    
            for_each_possible_cpu(i)
                   vfree(*per_cpu_ptr(scratches, i));
    Trying to free non existent page, causing warning: trying to vfree
    existent vm area.
            ...
    }
    
    Fix this breakage by updating ipcomp_scrtches with NULL when scratches
    is freed
    Suggested-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Reported-by: syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com
    Tested-by: syzbot+5ec9bb042ddfe9644773@syzkaller.appspotmail.com
    Signed-off-by: default avatarKhalid Masum <khalid.masum.92@gmail.com>
    Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    8a04d2fc
xfrm_ipcomp.c 7.4 KB