diff options
| author | Eric Dumazet <edumazet@google.com> | 2022-04-13 10:35:42 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-27 13:39:43 +0200 |
| commit | acff67727dff061f107def4c8c08bacde20d0d40 (patch) | |
| tree | 30b53fee39fa39c0a017eda8f6c42a341e6a2997 /net/sched | |
| parent | 9be70070b00c9f3a55d89a98f08264725cf45981 (diff) | |
| download | linux-stable-acff67727dff061f107def4c8c08bacde20d0d40.tar.gz linux-stable-acff67727dff061f107def4c8c08bacde20d0d40.tar.bz2 linux-stable-acff67727dff061f107def4c8c08bacde20d0d40.zip | |
net/sched: cls_u32: fix possible leak in u32_init_knode()
[ Upstream commit ec5b0f605b105457f257f2870acad4a5d463984b ]
While investigating a related syzbot report,
I found that whenever call to tcf_exts_init()
from u32_init_knode() is failing, we end up
with an elevated refcount on ht->refcnt
To avoid that, only increase the refcount after
all possible errors have been evaluated.
Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_u32.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index fe246e03fcd9..5eee26cf9011 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -873,10 +873,6 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, new->flags = n->flags; RCU_INIT_POINTER(new->ht_down, ht); - /* bump reference count as long as we hold pointer to structure */ - if (ht) - ht->refcnt++; - #ifdef CONFIG_CLS_U32_PERF /* Statistics may be incremented by readers during update * so we must keep them in tact. When the node is later destroyed @@ -899,6 +895,10 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, return NULL; } + /* bump reference count as long as we hold pointer to structure */ + if (ht) + ht->refcnt++; + return new; } |