Commit 7518af64 authored Mar 13, 2020 by Cong Wang Committed by Greg Kroah-Hartman Apr 02, 2020

net_sched: cls_route: remove the right filter from hashtable



[ Upstream commit ef299cc3fa1a9e1288665a9fdc8bff55629fd359 ]

route4_change() allocates a new filter and copies values from
the old one. After the new filter is inserted into the hash
table, the old filter should be removed and freed, as the final
step of the update.

However, the current code mistakenly removes the new one. This
looks apparently wrong to me, and it causes double "free" and
use-after-free too, as reported by syzbot.

Reported-and-tested-by:  <syzbot+f9b32aaacd60305d9687@syzkaller.appspotmail.com>
Reported-and-tested-by:  <syzbot+2f8c233f131943d6056d@syzkaller.appspotmail.com>
Reported-and-tested-by:  <syzbot+9c2df9fd5e9445b74e01@syzkaller.appspotmail.com>
Fixes: 1109c005 ("net: sched: RCU cls_route")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent dfddfa8c

net/sched/cls_route.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -540,8 +540,8 @@ static int route4_change(struct net net, struct sk_buff in_skb,
		fp = &b->ht[h];
		for (pfp = rtnl_dereference(*fp); pfp;
		fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
		if (pfp == f) {
		*fp = f->next;
		if (pfp == fold) {
		rcu_assign_pointer(*fp, fold->next);
		break;
		}
		}