cls_flower: use tcf_exts_get_net() before call_rcu()

Hold netns refcnt before call_rcu() and release it after
the tcf_exts_destroy() is done.

Note, on ->destroy() path we have to respect the return value
of tcf_exts_get_net(), on other paths it should always return
true, so we don't need to care.

Cc: Lucas Bates <lucasb@mojatatu.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 5b5722c8b32c1a276f7441fb67baa0d16ba24ff2..7a838d1c1c0059bddb3da24a59ad73689fec1877 100644 (file)
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -218,13 +218,19 @@ static int fl_init(struct tcf_proto *tp)
        return 0;
 }
 
+static void __fl_destroy_filter(struct cls_fl_filter *f)
+{
+       tcf_exts_destroy(&f->exts);
+       tcf_exts_put_net(&f->exts);
+       kfree(f);
+}
+
 static void fl_destroy_filter_work(struct work_struct *work)
 {
        struct cls_fl_filter *f = container_of(work, struct cls_fl_filter, work);
 
        rtnl_lock();
-       tcf_exts_destroy(&f->exts);
-       kfree(f);
+       __fl_destroy_filter(f);
        rtnl_unlock();
 }
 
@@ -318,7 +324,10 @@ static void __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f)
        if (!tc_skip_hw(f->flags))
                fl_hw_destroy_filter(tp, f);
        tcf_unbind_filter(tp, &f->res);
-       call_rcu(&f->rcu, fl_destroy_filter);
+       if (tcf_exts_get_net(&f->exts))
+               call_rcu(&f->rcu, fl_destroy_filter);
+       else
+               __fl_destroy_filter(f);
 }
 
 static void fl_destroy_sleepable(struct work_struct *work)
@@ -988,6 +997,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                idr_replace_ext(&head->handle_idr, fnew, fnew->handle);
                list_replace_rcu(&fold->list, &fnew->list);
                tcf_unbind_filter(tp, &fold->res);
+               tcf_exts_get_net(&fold->exts);
                call_rcu(&fold->rcu, fl_destroy_filter);
        } else {
                list_add_tail_rcu(&fnew->list, &head->filters);