Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f2b1ae2 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-sched-use-after-free' 



Cong Wang says:

====================
net_sched: fix a use-after-free for tc actions

This patchset fixes a use-after-free reported by Lucas
and closes potential races too.

Please see each patch for details.
====================

Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 74784da8 ceffcc5e

include/net/act_api.h

+5 −1
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ 
struct tcf_idrinfo {

	spinlock_t	lock;

	struct idr	action_idr;

	struct net	*net;

};



struct tc_action_ops;
@@ -104,7 +105,7 @@ struct tc_action_net { 


static inline

int tc_action_net_init(struct tc_action_net *tn,

		       const struct tc_action_ops *ops)

		       const struct tc_action_ops *ops, struct net *net)

{

	int err = 0;
@@ -112,6 +113,7 @@ int tc_action_net_init(struct tc_action_net *tn, 
	if (!tn->idrinfo)

		return -ENOMEM;

	tn->ops = ops;

	tn->idrinfo->net = net;

	spin_lock_init(&tn->idrinfo->lock);

	idr_init(&tn->idrinfo->action_idr);

	return err;
@@ -122,7 +124,9 @@ void tcf_idrinfo_destroy(const struct tc_action_ops *ops, 


static inline void tc_action_net_exit(struct tc_action_net *tn)

{

	rtnl_lock();

	tcf_idrinfo_destroy(tn->ops, tn->idrinfo);

	rtnl_unlock();

	kfree(tn->idrinfo);

}

net/sched/act_api.c

+4 −0
Original line number Diff line number Diff line
@@ -78,6 +78,7 @@ static void tcf_idr_remove(struct tcf_idrinfo *idrinfo, struct tc_action *p) 
	spin_lock_bh(&idrinfo->lock);

	idr_remove_ext(&idrinfo->action_idr, p->tcfa_index);

	spin_unlock_bh(&idrinfo->lock);

	put_net(idrinfo->net);

	gen_kill_estimator(&p->tcfa_rate_est);

	free_tcf(p);

}
@@ -86,6 +87,8 @@ int __tcf_idr_release(struct tc_action *p, bool bind, bool strict) 
{

	int ret = 0;



	ASSERT_RTNL();



	if (p) {

		if (bind)

			p->tcfa_bindcnt--;
@@ -334,6 +337,7 @@ int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est, 
	p->idrinfo = idrinfo;

	p->ops = ops;

	INIT_LIST_HEAD(&p->list);

	get_net(idrinfo->net);

	*a = p;

	return 0;

}

net/sched/act_bpf.c

+1 −1
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ static __net_init int bpf_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, bpf_net_id);



	return tc_action_net_init(tn, &act_bpf_ops);

	return tc_action_net_init(tn, &act_bpf_ops, net);

}



static void __net_exit bpf_exit_net(struct net *net)

net/sched/act_connmark.c

+1 −1
Original line number Diff line number Diff line
@@ -206,7 +206,7 @@ static __net_init int connmark_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, connmark_net_id);



	return tc_action_net_init(tn, &act_connmark_ops);

	return tc_action_net_init(tn, &act_connmark_ops, net);

}



static void __net_exit connmark_exit_net(struct net *net)

net/sched/act_csum.c

+1 −1
Original line number Diff line number Diff line
@@ -626,7 +626,7 @@ static __net_init int csum_init_net(struct net *net) 
{

	struct tc_action_net *tn = net_generic(net, csum_net_id);



	return tc_action_net_init(tn, &act_csum_ops);

	return tc_action_net_init(tn, &act_csum_ops, net);

}



static void __net_exit csum_exit_net(struct net *net)