]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
net: sched: fix potential use-after-free in __tcf_chain_put()
authorVlad Buslov <vladbu@mellanox.com>
Wed, 6 Mar 2019 15:50:43 +0000 (17:50 +0200)
committerDavid S. Miller <davem@davemloft.net>
Fri, 8 Mar 2019 23:17:47 +0000 (15:17 -0800)
commitb62989fc4ea27863e7aef00c93a10118324d3ed0
treef058a9a037433929d7d80d1194723eb988fe9811
parent81bf7bbeabd241326f4edc97f4f5ba366f21cbe0
net: sched: fix potential use-after-free in __tcf_chain_put()

When used with unlocked classifier that have filters attached to actions
with goto chain, __tcf_chain_put() for last non action reference can race
with calls to same function from action cleanup code that releases last
action reference. In this case action cleanup handler could free the chain
if it executes after all references to chain were released, but before all
concurrent users finished using it. Modify __tcf_chain_put() to only access
tcf_chain fields when holding block->lock. Remove local variables that were
used to cache some tcf_chain fields and are no longer needed because their
values can now be obtained directly from chain under block->lock
protection.

Fixes: 726d061286ce ("net: sched: prevent insertion of new classifiers during chain flush")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/cls_api.c