Commit 5d89fb33 authored Jul 13, 2017 by David Ahern Committed by David S. Miller Jul 13, 2017

net: set fib rule refcount after malloc

The configure callback of fib_rules_ops can change the refcnt of a
fib rule. For instance, mlxsw takes a refcnt when adding the processing
of the rule to a work queue. Thus the rule refcnt can not be reset to
to 1 afterwards. Move the refcnt setting to after the allocation.

Fixes: 5361e209 ("net: avoid one splat in fib_nl_delrule()")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 26837012

net/core/fib_rules.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -400,6 +400,7 @@ int fib_nl_newrule(struct sk_buff skb, struct nlmsghdr nlh,
		err = -ENOMEM;
		goto errout;
		}
		refcount_set(&rule->refcnt, 1);
		rule->fr_net = net;

		rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
		@@ -517,8 +518,6 @@ int fib_nl_newrule(struct sk_buff skb, struct nlmsghdr nlh,
		last = r;
		}

		refcount_set(&rule->refcnt, 1);

		if (last)
		list_add_rcu(&rule->list, &last->list);
		else