Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47cd2e18 authored by Vlad Buslov's avatar Vlad Buslov Committed by Greg Kroah-Hartman
Browse files

net: sched: act_sample: fix psample group handling on overwrite 



[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]

Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:

- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
  s->psample_group, even though we neither setting the pointer to NULL, nor
  preventing concurrent readers from accessing the pointer in some way.
  Use rcu_swap_protected() instead to safely reset the pointer.

- Old value of s->psample_group is not released or deallocated in any way,
  which results resource leak. Use psample_group_put() on non-NULL value
  obtained with rcu_swap_protected().

- The function psample_group_put() that released reference to struct
  psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
  grace period when deallocating it. Extend struct psample_group with rcu
  head and use kfree_rcu when freeing it.

Fixes: 5c5670fa ("net/sched: Introduce sample tc action")
Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e6521f6

include/net/psample.h

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ struct psample_group { 
	u32 group_num;

	u32 refcount;

	u32 seq;

	struct rcu_head rcu;

};



struct psample_group *psample_group_get(struct net *net, u32 group_num);

net/psample/psample.c

+1 −1
Original line number Diff line number Diff line
@@ -156,7 +156,7 @@ static void psample_group_destroy(struct psample_group *group) 
{

	psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);

	list_del(&group->list);

	kfree(group);

	kfree_rcu(group, rcu);

}



static struct psample_group *

net/sched/act_sample.c

+4 −1
Original line number Diff line number Diff line
@@ -92,13 +92,16 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, 
			tcf_idr_release(*a, bind);

		return -ENOMEM;

	}

	RCU_INIT_POINTER(s->psample_group, psample_group);

	rcu_swap_protected(s->psample_group, psample_group,

			   lockdep_is_held(&s->tcf_lock));



	if (tb[TCA_SAMPLE_TRUNC_SIZE]) {

		s->truncate = true;

		s->trunc_size = nla_get_u32(tb[TCA_SAMPLE_TRUNC_SIZE]);

	}



	if (psample_group)

		psample_group_put(psample_group);

	if (ret == ACT_P_CREATED)

		tcf_idr_insert(tn, *a);

	return ret;