Commit d7aa04a5 authored Nov 20, 2017 by Roman Kapl Committed by David S. Miller Nov 24, 2017

net: sched: fix crash when deleting secondary chains



If you flush (delete) a filter chain other than chain 0 (such as when
deleting the device), the kernel may run into a use-after-free. The
chain refcount must not be decremented unless we are sure we are done
with the chain.

To reproduce the bug, run:
    ip link add dtest type dummy
    tc qdisc add dev dtest ingress
    tc filter add dev dtest chain 1  parent ffff: flower
    ip link del dtest

Introduced in: commit f93e1cdc ("net/sched: fix filter flushing"),
but unless you have KAsan or luck, you won't notice it until
commit 0dadc117 ("cls_flower: use tcf_exts_get_net() before call_rcu()")

Fixes: f93e1cdc ("net/sched: fix filter flushing")
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Roman Kapl <code@rkapl.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 0cc03504

net/sched/cls_api.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -205,13 +205,14 @@ static void tcf_chain_head_change(struct tcf_chain *chain,

		static void tcf_chain_flush(struct tcf_chain *chain)
		{
		struct tcf_proto *tp;
		struct tcf_proto *tp = rtnl_dereference(chain->filter_chain);

		tcf_chain_head_change(chain, NULL);
		while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
		while (tp) {
		RCU_INIT_POINTER(chain->filter_chain, tp->next);
		tcf_chain_put(chain);
		tcf_proto_destroy(tp);
		tp = rtnl_dereference(chain->filter_chain);
		tcf_chain_put(chain);
		}
		}