Patch "xfrm: Fix a race in the xdst pcpu cache." has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

xfrm: Fix a race in the xdst pcpu cache.

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Steffen Klassert <[email protected]>
Date: Wed, 10 Jan 2018 12:14:28 +0100
Subject: xfrm: Fix a race in the xdst pcpu cache.

From: Steffen Klassert <[email protected]>

commit 76a4201191814a0061cb5c861fafb9ecaa764846 upstream.

We need to run xfrm_resolve_and_create_bundle() with bottom halves off. Otherwise we may reuse an already released dst_enty when the xfrm lookup functions are called from process context.

---
 net/xfrm/xfrm_policy.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

@@ -2056,8 +2056,11 @@ xfrm_bundle_lookup(struct net *net, cons
 	if (num_xfrms <= 0)
 		goto make_dummy_bundle;
 
+	local_bh_disable();
 	xdst = xfrm_resolve_and_create_bundle(pols, num_pols, fl, family,
-						  xflo->dst_orig);
+					      xflo->dst_orig);
+	local_bh_enable();
+
 	if (IS_ERR(xdst)) {
 		err = PTR_ERR(xdst);
 		if (err != -EAGAIN)

@@ -2144,9 +2147,12 @@ struct dst_entry *xfrm_lookup(struct net
 				goto no_transform;
 			}
 
+			local_bh_disable();
 			xdst = xfrm_resolve_and_create_bundle(
 					pols, num_pols, fl,
 					family, dst_orig);
+			local_bh_enable();
+
 			if (IS_ERR(xdst)) {
 				xfrm_pols_put(pols, num_pols);
 				err = PTR_ERR(xdst);

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/xfrm-fix-a-race-in-the-xdst-pcpu-cache.patch