Re: [PATCH] xfrm: policy: Fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

[Florian Westphal]

Sanghyun Park <sanghyun.park.cnu@xxxxxxxxx> wrote:
> Fix by pruning the bin while still holding xfrm_policy_lock, before
> dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the
> lock is already held. This is safe because the function uses
> kfree_rcu() for the actual free, which is non-blocking. The wrapper
> xfrm_policy_inexact_prune_bin() becomes unused and is removed.
> 
> Race:
> 
>   CPU0 (XFRM_MSG_DELPOLICY)         CPU1 (XFRM_MSG_NEWSPDINFO)
>   ============================       ==========================
>   xfrm_policy_bysel_ctx():
>     spin_lock_bh(xfrm_policy_lock)
>     bin = xfrm_policy_inexact_lookup()
>     __xfrm_policy_unlink(pol)
>     spin_unlock_bh(xfrm_policy_lock)
>     xfrm_policy_kill(ret)
>     // wide window, lock not held
>                                      xfrm_hash_rebuild():
>                                        spin_lock_bh(xfrm_policy_lock)
>                                        __xfrm_policy_inexact_flush():
>                                          kfree_rcu(bin)  // bin freed
>                                        spin_unlock_bh(xfrm_policy_lock)
>     xfrm_policy_inexact_prune_bin(bin)
>     // UAF: bin is freed

This changelog is fine, rest is too verbose.

> Fixes: 9cf545ebd5d8 ("xfrm: policy: implement selector-based inexact lookup")

There is no such commit, neither ID nor subject.
If you use AI assistance, please check for hallucinations.

Probably:
Fixes: 6be3b0db6db8 ("xfrm: policy: add inexact policy search tree infrastructure")

> + if (bin && ret && delete)
> + __xfrm_policy_inexact_prune_bin(bin, false);

Looks like this patch is whitespace-damaged.
Could you also say in changelog why you added the 3rd criterion?

> - if (bin && delete)

Became (bin && ret && delete).