diff options
author | Vlad Buslov <vladbu@mellanox.com> | 2019-08-27 21:49:38 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-09-10 10:33:38 +0100 |
commit | 5ff0ab0c668bea6add5c879598abc759e8d9355d (patch) | |
tree | c18acbbceafb453389ec9ef5da3ae049969fde6e /net | |
parent | 6a2bd826163052ed3b7f4817de46d4d89d78263c (diff) | |
download | linux-stable-5ff0ab0c668bea6add5c879598abc759e8d9355d.tar.gz linux-stable-5ff0ab0c668bea6add5c879598abc759e8d9355d.tar.bz2 linux-stable-5ff0ab0c668bea6add5c879598abc759e8d9355d.zip |
net: sched: act_sample: fix psample group handling on overwrite
[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]
Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:
- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
s->psample_group, even though we neither setting the pointer to NULL, nor
preventing concurrent readers from accessing the pointer in some way.
Use rcu_swap_protected() instead to safely reset the pointer.
- Old value of s->psample_group is not released or deallocated in any way,
which results resource leak. Use psample_group_put() on non-NULL value
obtained with rcu_swap_protected().
- The function psample_group_put() that released reference to struct
psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
grace period when deallocating it. Extend struct psample_group with rcu
head and use kfree_rcu when freeing it.
Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/psample/psample.c | 2 | ||||
-rw-r--r-- | net/sched/act_sample.c | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/net/psample/psample.c b/net/psample/psample.c index 64f95624f219..4cea353221da 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -156,7 +156,7 @@ static void psample_group_destroy(struct psample_group *group) { psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP); list_del(&group->list); - kfree(group); + kfree_rcu(group, rcu); } static struct psample_group * diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c index ac37654ca292..34ff6c30d1e6 100644 --- a/net/sched/act_sample.c +++ b/net/sched/act_sample.c @@ -99,7 +99,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, s->tcf_action = parm->action; s->rate = rate; s->psample_group_num = psample_group_num; - RCU_INIT_POINTER(s->psample_group, psample_group); + rcu_swap_protected(s->psample_group, psample_group, + lockdep_is_held(&s->tcf_lock)); if (tb[TCA_SAMPLE_TRUNC_SIZE]) { s->truncate = true; @@ -107,6 +108,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, } spin_unlock_bh(&s->tcf_lock); + if (psample_group) + psample_group_put(psample_group); if (ret == ACT_P_CREATED) tcf_idr_insert(tn, *a); return ret; |