Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47fd92f5 authored by Hiroaki SHIMODA's avatar Hiroaki SHIMODA Committed by David S. Miller
Browse files

net_sched: act: Delete estimator in error path. 



Some action modules free struct tcf_common in their error path
while estimator is still active. This results in est_timer()
dereference freed memory.
Add gen_kill_estimator() in ipt, pedit and simple action.

Signed-off-by: default avatarHiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9871f1ad

net/sched/act_ipt.c

+6 −1
Original line number Diff line number Diff line
@@ -185,7 +185,12 @@ err3: 
err2:

	kfree(tname);

err1:

	kfree(pc);

	if (ret == ACT_P_CREATED) {

		if (est)

			gen_kill_estimator(&pc->tcfc_bstats,

					   &pc->tcfc_rate_est);

		kfree_rcu(pc, tcfc_rcu);

	}

	return err;

}

net/sched/act_pedit.c

+4 −1
Original line number Diff line number Diff line
@@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est, 
		p = to_pedit(pc);

		keys = kmalloc(ksize, GFP_KERNEL);

		if (keys == NULL) {

			kfree(pc);

			if (est)

				gen_kill_estimator(&pc->tcfc_bstats,

						   &pc->tcfc_rate_est);

			kfree_rcu(pc, tcfc_rcu);

			return -ENOMEM;

		}

		ret = ACT_P_CREATED;

net/sched/act_simple.c

+4 −1
Original line number Diff line number Diff line
@@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est, 
		d = to_defact(pc);

		ret = alloc_defdata(d, defdata);

		if (ret < 0) {

			kfree(pc);

			if (est)

				gen_kill_estimator(&pc->tcfc_bstats,

						   &pc->tcfc_rate_est);

			kfree_rcu(pc, tcfc_rcu);

			return ret;

		}

		d->tcf_action = parm->action;