iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'net-sched-couple-of-chain-fixes'

Browse Source 
Jiri Pirko says:

====================
net: sched: couple of chain fixes

Jiri Pirko (2):
  net: sched: fix use after free when tcf_chain_destroy is called
    multiple times
  net: sched: don't do tcf_chain_flush from tcf_chain_destroy
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2017-08-22 14:39:59 -07:00
commit e188245d02
1 changed files with 12 additions and 4 deletions

16
net/sched/cls_api.c

@ -215,9 +215,15 @@ static void tcf_chain_flush(struct tcf_chain *chain)
static void tcf_chain_destroy(struct tcf_chain *chain)
{
list_del(&chain->list);
tcf_chain_flush(chain);
kfree(chain);
/* May be already removed from the list by the previous call. */
if (!list_empty(&chain->list))
list_del_init(&chain->list);
/* There might still be a reference held when we got here from
* tcf_block_put. Wait for the user to drop reference before free.
*/
if (!chain->refcnt)
kfree(chain);
}
struct tcf_chain *tcf_chain_get(struct tcf_block *block, u32 chain_index,
@ -288,8 +294,10 @@ void tcf_block_put(struct tcf_block *block)
if (!block)
return;
list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {
tcf_chain_flush(chain);
tcf_chain_destroy(chain);
}
kfree(block);
}
EXPORT_SYMBOL(tcf_block_put);