diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-09-27 13:42:19 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-12-14 10:18:10 +0100 |
| commit | f9ff09e266ca70c801b9911280f6ae64c9183d85 (patch) | |
| tree | c601f0aff5961df1a749c15f366556e7d9d01ef0 | |
| parent | d7b6d5f0e9c681c9390d25af8d23606e12fbc5f8 (diff) | |
net_sched: fix a crash in tc_new_tfilter()
commit 460b360104d51552a57f39e54b2589c9fd7fa0b3 upstream.
When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.
Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/sched/cls_api.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index b5da2c7a8092..435911dc9f16 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -629,8 +629,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q, errout_rcu: rcu_read_unlock(); errout_qdisc: - if (*q) + if (*q) { qdisc_put(*q); + *q = NULL; + } return ERR_PTR(err); } |