Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9ff09e2 authored by Cong Wang's avatar Cong Wang Committed by Greg Kroah-Hartman
Browse files

net_sched: fix a crash in tc_new_tfilter() 



commit 460b360104d51552a57f39e54b2589c9fd7fa0b3 upstream.

When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.

Reported-by: default avatar <syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com>
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d7b6d5f0

net/sched/cls_api.c

+3 −1
Original line number Diff line number Diff line
@@ -629,8 +629,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q, 
errout_rcu:

	rcu_read_unlock();

errout_qdisc:

	if (*q)

	if (*q) {

		qdisc_put(*q);

		*q = NULL;

	}

	return ERR_PTR(err);

}