Commit 1e46ef17 authored Mar 19, 2018 by Davide Caratti Committed by David S. Miller Mar 21, 2018

net/sched: fix idr leak in the error path of __tcf_ipt_init()



__tcf_ipt_init() can fail after the idr has been successfully reserved.
When this happens, subsequent attempts to configure xt/ipt rules using
the same idr value systematically fail with -ENOSPC:

 # tc action add action xt -j LOG --log-prefix test1 index 100
 tablename: mangle hook: NF_IP_POST_ROUTING
         target:  LOG level warning prefix "test1" index 100
 RTNETLINK answers: Cannot allocate memory
 We have an error talking to the kernel
 Command "(null)" is unknown, try "tc actions help".
 # tc action add action xt -j LOG --log-prefix test1 index 100
 tablename: mangle hook: NF_IP_POST_ROUTING
         target:  LOG level warning prefix "test1" index 100
 RTNETLINK answers: No space left on device
 We have an error talking to the kernel
 Command "(null)" is unknown, try "tc actions help".
 # tc action add action xt -j LOG --log-prefix test1 index 100
 tablename: mangle hook: NF_IP_POST_ROUTING
         target:  LOG level warning prefix "test1" index 100
 RTNETLINK answers: No space left on device
 We have an error talking to the kernel
 ...

Fix this in the error path of __tcf_ipt_init(), calling tcf_idr_release()
in place of tcf_idr_cleanup(). Since tcf_ipt_release() can now be called
when tcfi_t is NULL, we also need to protect calls to ipt_destroy_target()
to avoid NULL pointer dereference.

Fixes: 65a206c0 ("net/sched: Change act_api and act_xxx modules to use IDR")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 94fa3f92

net/sched/act_ipt.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -80,10 +80,13 @@ static void ipt_destroy_target(struct xt_entry_target *t)
		static void tcf_ipt_release(struct tc_action *a)
		{
		struct tcf_ipt *ipt = to_ipt(a);

		if (ipt->tcfi_t) {
		ipt_destroy_target(ipt->tcfi_t);
		kfree(ipt->tcfi_tname);
		kfree(ipt->tcfi_t);
		}
		kfree(ipt->tcfi_tname);
		}

		static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
		[TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ },
		@@ -187,7 +190,7 @@ static int __tcf_ipt_init(struct net net, unsigned int id, struct nlattr nla,
		kfree(tname);
		err1:
		if (ret == ACT_P_CREATED)
		tcf_idr_cleanup(*a, est);
		tcf_idr_release(*a, bind);
		return err;
		}