Commit 8c5ca649 authored Apr 13, 2022 by Eric Dumazet Committed by Greg Kroah-Hartman Apr 27, 2022

net/sched: cls_u32: fix possible leak in u32_init_knode()



[ Upstream commit ec5b0f605b105457f257f2870acad4a5d463984b ]

While investigating a related syzbot report,
I found that whenever call to tcf_exts_init()
from u32_init_knode() is failing, we end up
with an elevated refcount on ht->refcnt

To avoid that, only increase the refcount after
all possible errors have been evaluated.

Fixes: b9a24bb7 ("net_sched: properly handle failure case of tcf_exts_init()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent f883def5

net/sched/cls_u32.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -816,10 +816,6 @@ static struct tc_u_knode u32_init_knode(struct net net, struct tcf_proto *tp,
		new->flags = n->flags;
		RCU_INIT_POINTER(new->ht_down, ht);

		/* bump reference count as long as we hold pointer to structure */
		if (ht)
		ht->refcnt++;

		#ifdef CONFIG_CLS_U32_PERF
		/* Statistics may be incremented by readers during update
		* so we must keep them in tact. When the node is later destroyed
		@@ -841,6 +837,10 @@ static struct tc_u_knode u32_init_knode(struct net net, struct tcf_proto *tp,
		return NULL;
		}

		/* bump reference count as long as we hold pointer to structure */
		if (ht)
		ht->refcnt++;

		return new;
		}