Commit d7443185 authored by WANG Cong's avatar WANG Cong Committed by David S. Miller

net_sched: fix a use-after-free in tc_ctl_tfilter()

When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.

For long term, we probably should move tp list to list_head.

Fixes: 1e052be6 ("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1006da19
...@@ -308,12 +308,11 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n) ...@@ -308,12 +308,11 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
case RTM_DELTFILTER: case RTM_DELTFILTER:
err = tp->ops->delete(tp, fh); err = tp->ops->delete(tp, fh);
if (err == 0) { if (err == 0) {
tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER); struct tcf_proto *next = rtnl_dereference(tp->next);
if (tcf_destroy(tp, false)) {
struct tcf_proto *next = rtnl_dereference(tp->next);
tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
if (tcf_destroy(tp, false))
RCU_INIT_POINTER(*back, next); RCU_INIT_POINTER(*back, next);
}
} }
goto errout; goto errout;
case RTM_GETTFILTER: case RTM_GETTFILTER:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment