Commit b62989fc authored by Vlad Buslov's avatar Vlad Buslov Committed by David S. Miller

net: sched: fix potential use-after-free in __tcf_chain_put()

When used with unlocked classifier that have filters attached to actions
with goto chain, __tcf_chain_put() for last non action reference can race
with calls to same function from action cleanup code that releases last
action reference. In this case action cleanup handler could free the chain
if it executes after all references to chain were released, but before all
concurrent users finished using it. Modify __tcf_chain_put() to only access
tcf_chain fields when holding block->lock. Remove local variables that were
used to cache some tcf_chain fields and are no longer needed because their
values can now be obtained directly from chain under block->lock
protection.

Fixes: 726d0612 ("net: sched: prevent insertion of new classifiers during chain flush")
Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 81bf7bbe
...@@ -470,10 +470,9 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act, ...@@ -470,10 +470,9 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
{ {
struct tcf_block *block = chain->block; struct tcf_block *block = chain->block;
const struct tcf_proto_ops *tmplt_ops; const struct tcf_proto_ops *tmplt_ops;
bool is_last, free_block = false; bool free_block = false;
unsigned int refcnt; unsigned int refcnt;
void *tmplt_priv; void *tmplt_priv;
u32 chain_index;
mutex_lock(&block->lock); mutex_lock(&block->lock);
if (explicitly_created) { if (explicitly_created) {
...@@ -492,23 +491,21 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act, ...@@ -492,23 +491,21 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
* save these to temporary variables. * save these to temporary variables.
*/ */
refcnt = --chain->refcnt; refcnt = --chain->refcnt;
is_last = refcnt - chain->action_refcnt == 0;
tmplt_ops = chain->tmplt_ops; tmplt_ops = chain->tmplt_ops;
tmplt_priv = chain->tmplt_priv; tmplt_priv = chain->tmplt_priv;
chain_index = chain->index;
if (refcnt == 0)
free_block = tcf_chain_detach(chain);
mutex_unlock(&block->lock);
/* The last dropped non-action reference will trigger notification. */ /* The last dropped non-action reference will trigger notification. */
if (is_last && !by_act) { if (refcnt - chain->action_refcnt == 0 && !by_act) {
tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain_index, tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index,
block, NULL, 0, 0, false); block, NULL, 0, 0, false);
/* Last reference to chain, no need to lock. */ /* Last reference to chain, no need to lock. */
chain->flushing = false; chain->flushing = false;
} }
if (refcnt == 0)
free_block = tcf_chain_detach(chain);
mutex_unlock(&block->lock);
if (refcnt == 0) { if (refcnt == 0) {
tc_chain_tmplt_del(tmplt_ops, tmplt_priv); tc_chain_tmplt_del(tmplt_ops, tmplt_priv);
tcf_chain_destroy(chain, free_block); tcf_chain_destroy(chain, free_block);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment