Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e0479b67 authored by Vlad Buslov's avatar Vlad Buslov Committed by David S. Miller
Browse files

net: sched: fix unprotected access to rcu cookie pointer 



Fix action attribute size calculation function to take rcu read lock and
access act_cookie pointer with rcu dereference.

Fixes: eec94fdb ("net: sched: use rcu for action cookie update")
Reported-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
Reviewed-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2368957a

net/sched/act_api.c

+7 −2
Original line number Diff line number Diff line
@@ -149,10 +149,15 @@ EXPORT_SYMBOL(__tcf_idr_release); 


static size_t tcf_action_shared_attrs_size(const struct tc_action *act)

{

	struct tc_cookie *act_cookie;

	u32 cookie_len = 0;



	if (act->act_cookie)

		cookie_len = nla_total_size(act->act_cookie->len);

	rcu_read_lock();

	act_cookie = rcu_dereference(act->act_cookie);



	if (act_cookie)

		cookie_len = nla_total_size(act_cookie->len);

	rcu_read_unlock();



	return  nla_total_size(0) /* action number nested */

		+ nla_total_size(IFNAMSIZ) /* TCA_ACT_KIND */