[PATCH ipsec 0/2] xfrm: fix state lifetimes in xfrm_migrate()

[Cen Zhang]

xfrm_migrate() keeps the old states in x_cur[] and their successors in
x_new[], but it does not hold a reference to every state it later
deletes. An SA with a hard lifetime can expire and be freed by the timer
and the state GC in that window, and the following xfrm_state_delete()
takes the lock of freed memory:

  1/2 The success path drops the lookup references of the old states
      before it deletes them. Delete them first.

  2/2 xfrm_state_migrate() returns the published successor without a
      caller reference, so the rollback deletes states it does not
      hold. Take that reference before publishing and drop it after the
      migration commits or rolls back.

Both windows date back to the initial migration support and are reached
by XFRM_MSG_MIGRATE and PF_KEY's SADB_X_MIGRATE.

Cen Zhang (2):
  xfrm: keep old state references until migration deletion completes
  xfrm: hold migrated states through rollback

 net/xfrm/xfrm_policy.c | 7 +++++--
 net/xfrm/xfrm_state.c  | 6 +++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

---