summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorRoman Kapl <code@rkapl.cz>2017-11-20 22:21:13 +0100
committerDavid S. Miller <davem@davemloft.net>2017-11-24 01:25:37 +0900
commitd7aa04a5e82b4f254d306926c81eae8df69e5200 (patch)
tree58ef4949cc32041b00d14eeaa0aef4587331a45e /net
parent0cc03504c9f1b9c9da819094db37507c69ee9145 (diff)
downloadlinux-stable-d7aa04a5e82b4f254d306926c81eae8df69e5200.tar.gz
linux-stable-d7aa04a5e82b4f254d306926c81eae8df69e5200.tar.bz2
linux-stable-d7aa04a5e82b4f254d306926c81eae8df69e5200.zip
net: sched: fix crash when deleting secondary chains
If you flush (delete) a filter chain other than chain 0 (such as when deleting the device), the kernel may run into a use-after-free. The chain refcount must not be decremented unless we are sure we are done with the chain. To reproduce the bug, run: ip link add dtest type dummy tc qdisc add dev dtest ingress tc filter add dev dtest chain 1 parent ffff: flower ip link del dtest Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"), but unless you have KAsan or luck, you won't notice it until commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()") Fixes: f93e1cdcf42c ("net/sched: fix filter flushing") Acked-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Roman Kapl <code@rkapl.cz> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/sched/cls_api.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index ab255b421781..7d97f612c9b9 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,13 +205,14 @@ static void tcf_chain_head_change(struct tcf_chain *chain,
static void tcf_chain_flush(struct tcf_chain *chain)
{
- struct tcf_proto *tp;
+ struct tcf_proto *tp = rtnl_dereference(chain->filter_chain);
tcf_chain_head_change(chain, NULL);
- while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
+ while (tp) {
RCU_INIT_POINTER(chain->filter_chain, tp->next);
- tcf_chain_put(chain);
tcf_proto_destroy(tp);
+ tp = rtnl_dereference(chain->filter_chain);
+ tcf_chain_put(chain);
}
}