]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
net_sched: fix a crash in tc_new_tfilter()
authorCong Wang <xiyou.wangcong@gmail.com>
Thu, 27 Sep 2018 20:42:19 +0000 (13:42 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 2 Oct 2018 06:09:41 +0000 (23:09 -0700)
When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.

Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/cls_api.c

index 3de47e99b788f81e914efebe9ef89e7f32c1f4bc..d670d3066ebd6c2f3cd1220b5447f31d252d97b4 100644 (file)
@@ -717,8 +717,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q,
 errout_rcu:
        rcu_read_unlock();
 errout_qdisc:
-       if (*q)
+       if (*q) {
                qdisc_put(*q);
+               *q = NULL;
+       }
        return ERR_PTR(err);
 }