diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-09-27 23:42:19 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-10-02 09:09:41 +0300 |
| commit | 460b360104d51552a57f39e54b2589c9fd7fa0b3 (patch) | |
| tree | 84082e01896498cde177e058e72e6509786055bf | |
| parent | a1fa80802cb02cb043fd61b87bc81c06a38b4bb1 (diff) | |
| download | linux-460b360104d51552a57f39e54b2589c9fd7fa0b3.tar.xz | |
net_sched: fix a crash in tc_new_tfilter()
When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.
Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/cls_api.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 3de47e99b788..d670d3066ebd 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -717,8 +717,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q, errout_rcu: rcu_read_unlock(); errout_qdisc: - if (*q) + if (*q) { qdisc_put(*q); + *q = NULL; + } return ERR_PTR(err); } |