Messages in this thread | | | Date | Sun, 6 Nov 2022 09:49:16 -0800 | From | Cong Wang <> | Subject | Re: [PATCH] net: sched: fix memory leak in tcindex_set_parms |
| |
On Sun, Nov 06, 2022 at 10:55:31PM +0800, Hawkins Jiawei wrote: > Hi Cong, > > > > > > > diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c > > index 1c9eeb98d826..00a6c04a4b42 100644 > > --- a/net/sched/cls_tcindex.c > > +++ b/net/sched/cls_tcindex.c > > @@ -479,6 +479,7 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, > > } > > > > if (old_r && old_r != r) { > > + tcf_exts_destroy(&old_r->exts); > > err = tcindex_filter_result_init(old_r, cp, net); > > if (err < 0) { > > kfree(f); > > As for the position of the tcf_exts_destroy(), should we > call it after the RCU updating, after > `rcu_assign_pointer(tp->root, cp)` ? > > Or the concurrent RCU readers may derefer this freed memory > (Please correct me If I am wrong).
I don't think so, because we already have tcf_exts_change() in multiple places within tcindex_set_parms(). Even if this is really a problem, moving it after rcu_assign_pointer() does not help, you need to wait for a grace period.
Thanks.
| |