diff options
| author | Jiri Pirko <jiri@mellanox.com> | 2017-12-15 12:40:12 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-12-15 21:43:12 +0100 |
| commit | 343723dd51ef1025a860e54df9472b5ba21ee3d9 (patch) | |
| tree | 6611f40a0342dca4fad113db640e0371471f8f62 /net/sched/cls_api.c | |
| parent | ip_gre: fix wrong return value of erspan_rcv (diff) | |
| download | linux-343723dd51ef1025a860e54df9472b5ba21ee3d9.tar.xz linux-343723dd51ef1025a860e54df9472b5ba21ee3d9.zip | |
net: sched: fix clsact init error path
Since in qdisc_create, the destroy op is called when init fails, we
don't do cleanup in init and leave it up to destroy.
This fixes use-after-free when trying to put already freed block.
Fixes: 6e40cf2d4dee ("net: sched: use extended variants of block_get/put in ingress and clsact qdiscs")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/cls_api.c')
| -rw-r--r-- | net/sched/cls_api.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index f40256a3e7f0..b91ea03e3afa 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -351,6 +351,8 @@ void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q, { struct tcf_chain *chain; + if (!block) + return; /* Hold a refcnt for all chains, except 0, so that they don't disappear * while we are iterating. */ @@ -377,8 +379,6 @@ void tcf_block_put(struct tcf_block *block) { struct tcf_block_ext_info ei = {0, }; - if (!block) - return; tcf_block_put_ext(block, block->q, &ei); } |