Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12186be7 authored by Minoru Usui's avatar Minoru Usui Committed by David S. Miller
Browse files

net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel... 


net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup

This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained.  After it's chained,
tc_ctl_tfilter() calls classifier's change().  When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

In addition, cls_cgroup is initialized in change() not in init().  It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.

Signed-off-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: default avatarJamal Hadi Salim <hadi@cyberus.ca>
Tested-by: default avatarMinoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ea30e119

net/sched/cls_api.c

+17 −6
Original line number Diff line number Diff line
@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg) 
	unsigned long cl;

	unsigned long fh;

	int err;

	int tp_created = 0;



	if (net != &init_net)

		return -EINVAL;
@@ -266,10 +267,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg) 
			goto errout;

		}



		spin_lock_bh(root_lock);

		tp->next = *back;

		*back = tp;

		spin_unlock_bh(root_lock);

		tp_created = 1;



	} else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))

		goto errout;
@@ -296,8 +294,11 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg) 
		switch (n->nlmsg_type) {

		case RTM_NEWTFILTER:

			err = -EEXIST;

			if (n->nlmsg_flags & NLM_F_EXCL)

			if (n->nlmsg_flags & NLM_F_EXCL) {

				if (tp_created)

					tcf_destroy(tp);

				goto errout;

			}

			break;

		case RTM_DELTFILTER:

			err = tp->ops->delete(tp, fh);
@@ -314,8 +315,18 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg) 
	}



	err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);

	if (err == 0)

	if (err == 0) {

		if (tp_created) {

			spin_lock_bh(root_lock);

			tp->next = *back;

			*back = tp;

			spin_unlock_bh(root_lock);

		}

		tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);

	} else {

		if (tp_created)

			tcf_destroy(tp);

	}



errout:

	if (cl)