net: sched: act_sample: fix psample group handling on overwrite (dbf47a2a) · Commits · 戴 / test

Action sample doesn't properly handle psample_group pointer in overwrite case. Following issues need to be fixed: - In tcf_sample_init() function RCU_INIT_POINTER() is used to set s->psample_group, even though we neither setting the pointer to NULL, nor preventing concurrent readers from accessing the pointer in some way. Use rcu_swap_protected() instead to safely reset the pointer. - Old value of s->psample_group is not released or deallocated in any way, which results resource leak. Use psample_group_put() on non-NULL value obtained with rcu_swap_protected(). - The function psample_group_put() that released reference to struct psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu grace period when deallocating it. Extend struct psample_group with rcu head and use kfree_rcu when freeing it. Fixes: ("net/sched: Introduce sample tc action") Signed-off-by:

Vlad Buslov <vladbu@mellanox.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

include/net/psample.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -11,6 +11,7 @@ struct psample_group {
		u32 group_num;
		u32 refcount;
		u32 seq;
		struct rcu_head rcu;
		};

		struct psample_group psample_group_get(struct net net, u32 group_num);

net/psample/psample.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -154,7 +154,7 @@ static void psample_group_destroy(struct psample_group *group)
		{
		psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
		list_del(&group->list);
		kfree(group);
		kfree_rcu(group, rcu);
		}

		static struct psample_group *

net/sched/act_sample.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -102,13 +102,17 @@ static int tcf_sample_init(struct net net, struct nlattr nla,
		goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
		s->rate = rate;
		s->psample_group_num = psample_group_num;
		RCU_INIT_POINTER(s->psample_group, psample_group);
		rcu_swap_protected(s->psample_group, psample_group,
		lockdep_is_held(&s->tcf_lock));

		if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
		s->truncate = true;
		s->trunc_size = nla_get_u32(tb[TCA_SAMPLE_TRUNC_SIZE]);
		}
		spin_unlock_bh(&s->tcf_lock);

		if (psample_group)
		psample_group_put(psample_group);
		if (goto_ch)
		tcf_chain_put_by_act(goto_ch);

Admin message