Commit 460b3601 authored Sep 27, 2018 by Cong Wang Committed by David S. Miller Oct 01, 2018

net_sched: fix a crash in tc_new_tfilter()

When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.

Reported-by: <syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com>
Fixes: e368fdb6 ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent a1fa8080

net/sched/cls_api.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -717,8 +717,10 @@ static struct tcf_block tcf_block_find(struct net net, struct Qdisc **q,
		errout_rcu:
		rcu_read_unlock();
		errout_qdisc:
		if (*q)
		if (*q) {
		qdisc_put(*q);
		*q = NULL;
		}
		return ERR_PTR(err);
		}