iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route'

Browse Source 
valis says:

====================
net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route

Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.

This patch set fixes this issue in all affected classifiers by no longer
copying the tcf_result struct from the old filter.
====================

Link: https://lore.kernel.org/r/20230729123202.72406-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski
2023-07-31 20:10:39 -07:00
parent 611e1b016c b80b829e9e
commit c5ccff7050
3 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
net/sched/cls_fw.c
View File

@ -267,7 +267,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
return -ENOBUFS; return -ENOBUFS;
fnew->id = f->id; fnew->id = f->id;
fnew->res = f->res;
fnew->ifindex = f->ifindex; fnew->ifindex = f->ifindex;
fnew->tp = f->tp; fnew->tp = f->tp;

1
net/sched/cls_route.c
View File

@ -513,7 +513,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
if (fold) { if (fold) {
f->id = fold->id; f->id = fold->id;
f->iif = fold->iif; f->iif = fold->iif;
f->res = fold->res;
f->handle = fold->handle; f->handle = fold->handle;
f->tp = fold->tp; f->tp = fold->tp;

1
net/sched/cls_u32.c
View File

@ -826,7 +826,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
new->ifindex = n->ifindex; new->ifindex = n->ifindex;
new->fshift = n->fshift; new->fshift = n->fshift;
new->res = n->res;
new->flags = n->flags; new->flags = n->flags;
RCU_INIT_POINTER(new->ht_down, ht); RCU_INIT_POINTER(new->ht_down, ht);