Hyunwoo Kim f7ad8b1d0e espintcp: Fix race condition in espintcp_close() ...

[ Upstream commit e1512c1db9 ]

This issue was discovered during a code audit.

After cancel_work_sync() is called from espintcp_close(),
espintcp_tx_work() can still be scheduled from paths such as
the Delayed ACK handler or ksoftirqd.
As a result, the espintcp_tx_work() worker may dereference a
freed espintcp ctx or sk.

The following is a simple race scenario:

           cpu0                             cpu1

  espintcp_close()
    cancel_work_sync(&ctx->work);
                                     espintcp_write_space()
                                       schedule_work(&ctx->work);

To prevent this race condition, cancel_work_sync() is
replaced with disable_work_sync().

Fixes: e27cca96cd ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/aZSie7rEdh9Nu0eM@v4bel
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-04 07:21:31 -05:00

..

espintcp.c

espintcp: Fix race condition in espintcp_close()

2026-03-04 07:21:31 -05:00

Kconfig

…

Makefile

…

xfrm_algo.c

…

xfrm_compat.c

…

xfrm_device.c

xfrm: always flush state and policy upon NETDEV_UNREGISTER event

2026-03-04 07:21:31 -05:00

xfrm_hash.c

…

xfrm_hash.h

…

xfrm_inout.h

…

xfrm_input.c

…

xfrm_interface_bpf.c

…

xfrm_interface_core.c

…

xfrm_ipcomp.c

xfrm: delete x->tunnel as we delete x

2025-12-12 18:37:17 +01:00

xfrm_nat_keepalive.c

…

xfrm_output.c

xfrm: Prevent locally generated packets from direct output in tunnel mode

2025-12-01 11:43:29 +01:00

xfrm_policy.c

xfrm: skip templates check for packet offload tunnel mode

2026-03-04 07:21:31 -05:00

xfrm_proc.c

…

xfrm_replay.c

…

xfrm_state_bpf.c

…

xfrm_state.c

xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set

2026-01-23 11:18:35 +01:00

xfrm_sysctl.c

…

xfrm_user.c

Revert "xfrm: destroy xfrm_state synchronously on net exit path"

2025-12-12 18:37:17 +01:00