| Message ID | 20230504181616.2834983-4-vladbu@nvidia.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | fd741f0d9f702c193b2b44225c004f8c5d5be163 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Fixes for miss to tc action series | expand |
On 04/05/2023 15:16, Vlad Buslov wrote: > When replacing a filter (i.e. 'fold' pointer is not NULL) the insertion of > new filter to idr is postponed until later in code since handle is already > provided by the user. However, the error handling code in fl_change() > always assumes that the new filter had been inserted into idr. If error > handler is reached when replacing existing filter it may remove it from idr > therefore making it unreachable for delete or dump afterwards. Fix the > issue by verifying that 'fold' argument wasn't provided by caller before > calling idr_remove(). > > Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") > Signed-off-by: Vlad Buslov <vladbu@nvidia.com> Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> > --- > net/sched/cls_flower.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c > index ac4f344c52e0..9dbc43388e57 100644 > --- a/net/sched/cls_flower.c > +++ b/net/sched/cls_flower.c > @@ -2339,7 +2339,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, > errout_mask: > fl_mask_put(head, fnew->mask); > errout_idr: > - idr_remove(&head->handle_idr, fnew->handle); > + if (!fold) > + idr_remove(&head->handle_idr, fnew->handle); > __fl_put(fnew); > errout_tb: > kfree(tb);
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index ac4f344c52e0..9dbc43388e57 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -2339,7 +2339,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, errout_mask: fl_mask_put(head, fnew->mask); errout_idr: - idr_remove(&head->handle_idr, fnew->handle); + if (!fold) + idr_remove(&head->handle_idr, fnew->handle); __fl_put(fnew); errout_tb: kfree(tb);
When replacing a filter (i.e. 'fold' pointer is not NULL) the insertion of new filter to idr is postponed until later in code since handle is already provided by the user. However, the error handling code in fl_change() always assumes that the new filter had been inserted into idr. If error handler is reached when replacing existing filter it may remove it from idr therefore making it unreachable for delete or dump afterwards. Fix the issue by verifying that 'fold' argument wasn't provided by caller before calling idr_remove(). Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") Signed-off-by: Vlad Buslov <vladbu@nvidia.com> --- net/sched/cls_flower.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)