diff options
author | Jakub Kicinski | 2023-07-31 20:10:39 -0700 |
---|---|---|
committer | Jakub Kicinski | 2023-07-31 20:10:39 -0700 |
commit | c5ccff70501d92db445a135fa49cf9bc6b98c444 (patch) | |
tree | f4c5c3a4d75bf88d1e78c5aad27c156498b680a8 /net | |
parent | 611e1b016c7beceec5ae82ac62d4a7ca224c8f9d (diff) | |
parent | b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 (diff) |
Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route'
valis says:
====================
net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route
Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.
This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.
This patch set fixes this issue in all affected classifiers by no longer
copying the tcf_result struct from the old filter.
====================
Link: https://lore.kernel.org/r/20230729123202.72406-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/sched/cls_fw.c | 1 | ||||
-rw-r--r-- | net/sched/cls_route.c | 1 | ||||
-rw-r--r-- | net/sched/cls_u32.c | 1 |
3 files changed, 0 insertions, 3 deletions
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index 8641f8059317..c49d6af0e048 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -267,7 +267,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb, return -ENOBUFS; fnew->id = f->id; - fnew->res = f->res; fnew->ifindex = f->ifindex; fnew->tp = f->tp; diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c index d0c53724d3e8..1e20bbd687f1 100644 --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -513,7 +513,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb, if (fold) { f->id = fold->id; f->iif = fold->iif; - f->res = fold->res; f->handle = fold->handle; f->tp = fold->tp; diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 907e58841fe8..da4c179a4d41 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -826,7 +826,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, new->ifindex = n->ifindex; new->fshift = n->fshift; - new->res = n->res; new->flags = n->flags; RCU_INIT_POINTER(new->ht_down, ht); |