diff options
author | Vlad Buslov <vladbu@mellanox.com> | 2019-08-27 21:49:38 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-09-10 10:35:05 +0100 |
commit | 3c6dfd2adb7a71915ff2fb8e40e466d748078103 (patch) | |
tree | eddb21fd45349c00b7d75aeca4ecfd52f816e5dd /include | |
parent | 5038bd027ac331879445bfff36e9003f3fbfb007 (diff) | |
download | linux-stable-3c6dfd2adb7a71915ff2fb8e40e466d748078103.tar.gz linux-stable-3c6dfd2adb7a71915ff2fb8e40e466d748078103.tar.bz2 linux-stable-3c6dfd2adb7a71915ff2fb8e40e466d748078103.zip |
net: sched: act_sample: fix psample group handling on overwrite
[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]
Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:
- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
s->psample_group, even though we neither setting the pointer to NULL, nor
preventing concurrent readers from accessing the pointer in some way.
Use rcu_swap_protected() instead to safely reset the pointer.
- Old value of s->psample_group is not released or deallocated in any way,
which results resource leak. Use psample_group_put() on non-NULL value
obtained with rcu_swap_protected().
- The function psample_group_put() that released reference to struct
psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
grace period when deallocating it. Extend struct psample_group with rcu
head and use kfree_rcu when freeing it.
Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
-rw-r--r-- | include/net/psample.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/psample.h b/include/net/psample.h index 37a4df2325b2..6b578ce69cd8 100644 --- a/include/net/psample.h +++ b/include/net/psample.h @@ -11,6 +11,7 @@ struct psample_group { u32 group_num; u32 refcount; u32 seq; + struct rcu_head rcu; }; struct psample_group *psample_group_get(struct net *net, u32 group_num); |