[PATCH ipsec] xfrm: fix output state cache TOCTOU in xfrm_state_find()

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

xfrm_state_find() checks x->km.state outside the xfrm_state_lock before
inserting the state into the policy output state cache. Between the check
and the lock acquisition, __xfrm_state_delete() can transition the state
to XFRM_STATE_DEAD. The dead state is then inserted into the cache
because the stale validity result is trusted after the lock is acquired.

A subsequent call traversing the cache can then access a freed state,
since xfrm_state_gc_destroy() does not unlink from state_cache_list.

This is the output state cache counterpart of the input cache race
fixed by commit ddd3d01329203 ("xfrm: Fix xfrm state cache insertion
race"). Apply the same pattern: move the km.state validity check inside
the lock so the check and the insertion are atomic with respect to
__xfrm_state_delete().

Fixes: 0045e3d80613 ("xfrm: Cache used outbound xfrm states at the policy.")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 net/xfrm/xfrm_state.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e45aa1ed5b965..03baa50f0df7c 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1632,10 +1632,11 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
 		*err = acquire_in_progress ? -EAGAIN : error;
 	}
 
-	if (x && x->km.state == XFRM_STATE_VALID && !cached &&
+	if (x && !cached &&
 	    (!(pol->flags & XFRM_POLICY_CPU_ACQUIRE) || x->pcpu_num == pcpu_id)) {
 		spin_lock_bh(&net->xfrm.xfrm_state_lock);
-		if (hlist_unhashed(&x->state_cache))
+		if (x->km.state == XFRM_STATE_VALID &&
+		    hlist_unhashed(&x->state_cache))
 			hlist_add_head_rcu(&x->state_cache, &pol->state_cache_list);
 		spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 	}
-- 
2.47.3