Google Git Google Git
Sign in
linux/linux/kernel/git/klassert/ipsec/3eb841b771e81e0692b3ebfc75fdb774022cc4f6
commit
3eb841b771e81e0692b3ebfc75fdb774022cc4f6
[log]
author
Antony Antony <antony.antony@secunet.com>
Wed Oct 07 11:35:27 2026 +0200
committer
Steffen Klassert <steffen.klassert@secunet.com>
Mon Oct 19 08:02:05 2026 +0200
tree
9b16b09e4a8b8e942b2f278e0fac1d5de6ee1e64
parent
6362f459bfc485d805f0439ae4566c1b014abfa4 [diff] 
xfrm: fix use-after-free of migrated state in xfrm_do_migrate_state()

A concurrent delete can free the migrated state before
xfrm_do_migrate_state() finishes using it.

Fixes: a9d155ea9b44 ("xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
1 file changed
tree: 9b16b09e4a8b8e942b2f278e0fac1d5de6ee1e64
  1. arch/
  2. block/
  3. certs/
  4. crypto/
  5. Documentation/
  6. drivers/
  7. fs/
  8. include/
  9. init/
  10. io_uring/
  11. ipc/
  12. kernel/
  13. lib/
  14. LICENSES/
  15. mm/
  16. net/
  17. rust/
  18. samples/
  19. scripts/
  20. security/
  21. sound/
  22. tools/
  23. usr/
  24. virt/
  25. .clang-format
  26. .clippy.toml
  27. .cocciconfig
  28. .editorconfig
  29. .get_maintainer.ignore
  30. .gitattributes
  31. .gitignore
  32. .mailmap
  33. .pylintrc
  34. .rustfmt.toml
  35. COPYING
  36. CREDITS
  37. Kbuild
  38. Kconfig
  39. MAINTAINERS
  40. Makefile
  41. README