net_sched: hold rtnl lock in tcindex_partial_destroy_work()
[ Upstream commit5.4-rM2-2.2.x-imx-squashedb1be2e8cd2
] syzbot reported a use-after-free in tcindex_dump(). This is due to the lack of RTNL in the deferred rcu work. We queue this work with RTNL in tcindex_change(), later, tcindex_dump() is called: fh = tp->ops->get(tp, t->tcm_handle); ... err = tp->ops->change(..., &fh, ...); tfilter_notify(..., fh, ...); but there is nothing to serialize the pending tcindex_partial_destroy_work() with tcindex_dump(). Fix this by simply holding RTNL in tcindex_partial_destroy_work(), so that it won't be called until RTNL is released after tc_new_tfilter() is completed. Reported-and-tested-by: syzbot+653090db2562495901dc@syzkaller.appspotmail.com Fixes:3d210534cc
("net_sched: fix a race condition in tcindex_destroy()") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
ff28c61958
commit
5317abb870
|
@ -261,8 +261,10 @@ static void tcindex_partial_destroy_work(struct work_struct *work)
|
|||
struct tcindex_data,
|
||||
rwork);
|
||||
|
||||
rtnl_lock();
|
||||
kfree(p->perfect);
|
||||
kfree(p);
|
||||
rtnl_unlock();
|
||||
}
|
||||
|
||||
static void tcindex_free_perfect_hash(struct tcindex_data *cp)
|
||||
|
|
Loading…
Reference in New Issue