lkml.org 
[lkml]   [2022]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 037/146] net/sched: cls_u32: fix possible leak in u32_init_knode()
    Date
    From: Eric Dumazet <edumazet@google.com>

    [ Upstream commit ec5b0f605b105457f257f2870acad4a5d463984b ]

    While investigating a related syzbot report,
    I found that whenever call to tcf_exts_init()
    from u32_init_knode() is failing, we end up
    with an elevated refcount on ht->refcnt

    To avoid that, only increase the refcount after
    all possible errors have been evaluated.

    Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sched/cls_u32.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
    index fcba6c43ba50..4d27300c287c 100644
    --- a/net/sched/cls_u32.c
    +++ b/net/sched/cls_u32.c
    @@ -815,10 +815,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
    new->flags = n->flags;
    RCU_INIT_POINTER(new->ht_down, ht);

    - /* bump reference count as long as we hold pointer to structure */
    - if (ht)
    - ht->refcnt++;
    -
    #ifdef CONFIG_CLS_U32_PERF
    /* Statistics may be incremented by readers during update
    * so we must keep them in tact. When the node is later destroyed
    @@ -840,6 +836,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
    return NULL;
    }

    + /* bump reference count as long as we hold pointer to structure */
    + if (ht)
    + ht->refcnt++;
    +
    return new;
    }

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-04-26 11:25    [W:4.206 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site