lkml.org 
[lkml]   [2018]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 13/45] net sched actions: fix refcnt leak in skbmod
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Roman Mashak <mrv@mojatatu.com>

    [ Upstream commit a52956dfc503f8cc5cfe6454959b7049fddb4413 ]

    When application fails to pass flags in netlink TLV when replacing
    existing skbmod action, the kernel will leak refcnt:

    $ tc actions get action skbmod index 1
    total acts 0

    action order 0: skbmod pipe set smac 00:11:22:33:44:55
    index 1 ref 1 bind 0

    For example, at this point a buggy application replaces the action with
    index 1 with new smac 00:aa:22:33:44:55, it fails because of zero flags,
    however refcnt gets bumped:

    $ tc actions get actions skbmod index 1
    total acts 0

    action order 0: skbmod pipe set smac 00:11:22:33:44:55
    index 1 ref 2 bind 0
    $

    Tha patch fixes this by calling tcf_idr_release() on existing actions.

    Fixes: 86da71b57383d ("net_sched: Introduce skbmod action")
    Signed-off-by: Roman Mashak <mrv@mojatatu.com>
    Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sched/act_skbmod.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    --- a/net/sched/act_skbmod.c
    +++ b/net/sched/act_skbmod.c
    @@ -131,8 +131,11 @@ static int tcf_skbmod_init(struct net *n
    if (exists && bind)
    return 0;

    - if (!lflags)
    + if (!lflags) {
    + if (exists)
    + tcf_idr_release(*a, bind);
    return -EINVAL;
    + }

    if (!exists) {
    ret = tcf_idr_create(tn, parm->index, est, a,

    \
     
     \ /
      Last update: 2018-05-18 11:10    [W:4.041 / U:0.436 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site