Commit 78f1b04f authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tcf_foo_init-NULL-deref' 



Davide Caratti says:

====================
net/sched: fix NULL dereference in the error path of .init()

with several TC actions it's possible to see NULL pointer dereference,
when the .init() function calls tcf_idr_alloc(), fails at some point and
then calls tcf_idr_release(): this series fixes all them introducing
non-NULL tests in the .cleanup() function.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f9db5069 2d433610

net/sched/act_csum.c

+2 −1
Original line number Diff line number Diff line
@@ -626,6 +626,7 @@ static void tcf_csum_cleanup(struct tc_action *a) 
	struct tcf_csum_params *params;



	params = rcu_dereference_protected(p->params, 1);

	if (params)

		kfree_rcu(params, rcu);

}

net/sched/act_sample.c

+2 −1
Original line number Diff line number Diff line
@@ -103,6 +103,7 @@ static void tcf_sample_cleanup(struct tc_action *a) 


	psample_group = rtnl_dereference(s->psample_group);

	RCU_INIT_POINTER(s->psample_group, NULL);

	if (psample_group)

		psample_group_put(psample_group);

}

net/sched/act_skbmod.c

+2 −1
Original line number Diff line number Diff line
@@ -190,6 +190,7 @@ static void tcf_skbmod_cleanup(struct tc_action *a) 
	struct tcf_skbmod_params  *p;



	p = rcu_dereference_protected(d->skbmod_p, 1);

	if (p)

		kfree_rcu(p, rcu);

}

net/sched/act_tunnel_key.c

+5 −4
Original line number Diff line number Diff line
@@ -208,12 +208,13 @@ static void tunnel_key_release(struct tc_action *a) 
	struct tcf_tunnel_key_params *params;



	params = rcu_dereference_protected(t->params, 1);



	if (params) {

		if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)

			dst_release(&params->tcft_enc_metadata->dst);



		kfree_rcu(params, rcu);

	}

}



static int tunnel_key_dump_addresses(struct sk_buff *skb,

				     const struct ip_tunnel_info *info)

net/sched/act_vlan.c

+2 −1
Original line number Diff line number Diff line
@@ -225,6 +225,7 @@ static void tcf_vlan_cleanup(struct tc_action *a) 
	struct tcf_vlan_params *p;



	p = rcu_dereference_protected(v->vlan_p, 1);

	if (p)

		kfree_rcu(p, rcu);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE