Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit edbde451 authored by Cong Wang's avatar Cong Wang Committed by Greg Kroah-Hartman
Browse files

net_sched: fix a memory leak in atm_tc_init() 



[ Upstream commit 306381aec7c2b5a658eebca008c8a1b666536cba ]

When tcf_block_get() fails inside atm_tc_init(),
atm_tc_put() is called to release the qdisc p->link.q.
But the flow->ref prevents it to do so, as the flow->ref
is still zero.

Fix this by moving the p->link.ref initialization before
tcf_block_get().

Fixes: 6529eaba ("net: sched: introduce tcf block infractructure")
Reported-and-tested-by: default avatar <syzbot+d411cff6ab29cc2c311b@syzkaller.appspotmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d55dad8b

net/sched/sch_atm.c

+4 −4
Original line number Diff line number Diff line
@@ -553,16 +553,16 @@ static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt, 
	if (!p->link.q)

		p->link.q = &noop_qdisc;

	pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);

	p->link.vcc = NULL;

	p->link.sock = NULL;

	p->link.common.classid = sch->handle;

	p->link.ref = 1;



	err = tcf_block_get(&p->link.block, &p->link.filter_list, sch,

			    extack);

	if (err)

		return err;



	p->link.vcc = NULL;

	p->link.sock = NULL;

	p->link.common.classid = sch->handle;

	p->link.ref = 1;

	tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);

	return 0;

}