From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01670C04A94 for ; Tue, 15 Aug 2023 07:53:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235476AbjHOHw7 (ORCPT ); Tue, 15 Aug 2023 03:52:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235484AbjHOHwe (ORCPT ); Tue, 15 Aug 2023 03:52:34 -0400 Received: from 167-179-156-38.a7b39c.syd.nbn.aussiebb.net (167-179-156-38.a7b39c.syd.nbn.aussiebb.net [167.179.156.38]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 295821733; Tue, 15 Aug 2023 00:52:31 -0700 (PDT) Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1qVoq8-003twA-AO; Tue, 15 Aug 2023 15:51:45 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Tue, 15 Aug 2023 15:51:44 +0800 Date: Tue, 15 Aug 2023 15:51:44 +0800 From: Herbert Xu To: Leon Romanovsky Cc: Florian Westphal , Dong Chenchen , steffen.klassert@secunet.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, timo.teras@iki.fi, yuehaibing@huawei.com, weiyongjun1@huawei.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [Patch net, v2] net: xfrm: skip policies marked as dead while reinserting policies Message-ID: References: <20230814140013.712001-1-dongchenchen2@huawei.com> <20230815060026.GE22185@unreal> <20230815060454.GA2833@breakpoint.cc> <20230815073033.GJ22185@unreal> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230815073033.GJ22185@unreal> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Aug 15, 2023 at 10:30:33AM +0300, Leon Romanovsky wrote: > > But policy has, and we are not interested in validity of it as first > check in if (...) will be true for policy->walk.dead. > > So it is safe to call to dir = xfrm_policy_id2dir(policy->index) even > for dead policy. If you dereference policy->index on a walker object it will read memory before the start of the walker object. That could do anything, perhaps even triggering a page fault. Cheers, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt