1
0
Fork 0
alistair23-linux/net/sched
Vlad Buslov b62989fc4e net: sched: fix potential use-after-free in __tcf_chain_put()
When used with unlocked classifier that have filters attached to actions
with goto chain, __tcf_chain_put() for last non action reference can race
with calls to same function from action cleanup code that releases last
action reference. In this case action cleanup handler could free the chain
if it executes after all references to chain were released, but before all
concurrent users finished using it. Modify __tcf_chain_put() to only access
tcf_chain fields when holding block->lock. Remove local variables that were
used to cache some tcf_chain fields and are no longer needed because their
values can now be obtained directly from chain under block->lock
protection.

Fixes: 726d061286 ("net: sched: prevent insertion of new classifiers during chain flush")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-03-08 15:17:47 -08:00
..
Kconfig tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
Makefile tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
act_api.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_bpf.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_connmark.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_csum.c net: sched: act_csum: Fix csum calc for tagged packets 2019-02-27 21:49:46 -08:00
act_gact.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_ife.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_ipt.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-02 12:54:35 -08:00
act_meta_mark.c net: remove duplicate includes 2017-12-13 13:18:46 -05:00
act_meta_skbprio.c net sched actions: change IFE modules alias names 2017-10-12 22:13:20 -07:00
act_meta_skbtcindex.c net: remove duplicate includes 2017-12-13 13:18:46 -05:00
act_mirred.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_nat.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_pedit.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_police.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_sample.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_simple.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_skbedit.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-02 12:54:35 -08:00
act_skbmod.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
act_tunnel_key.c net/sched: act_tunnel_key: Fix double free dst_cache 2019-03-05 12:57:28 -08:00
act_vlan.c net: Change TCA_ACT_* to TCA_ID_* to match that of TCA_ID_POLICE 2019-02-10 09:28:43 -08:00
cls_api.c net: sched: fix potential use-after-free in __tcf_chain_put() 2019-03-08 15:17:47 -08:00
cls_basic.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_bpf.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_cgroup.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flow.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_flower.c net: sched: flower: insert new filter to idr after setting its mask 2019-03-06 10:52:16 -08:00
cls_fw.c Revert "net: sched: fw: don't set arg->stop in fw_walk() when empty" 2019-02-27 10:12:19 -08:00
cls_matchall.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_route.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_rsvp.c
cls_rsvp.h net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_rsvp6.c
cls_tcindex.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
cls_u32.c net_sched: initialize net pointer inside tcf_exts_init() 2019-02-22 15:26:51 -08:00
em_canid.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_cmp.c
em_ipset.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
em_ipt.c net: sched: add em_ipt ematch for calling xtables matches 2018-02-21 13:15:33 -05:00
em_meta.c net: convert sock.sk_refcnt from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
em_nbyte.c net: sched: em_nbyte: don't add the data offset twice 2018-01-24 14:52:40 -05:00
em_text.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
em_u32.c
ematch.c net: sched: ematch: obtain net pointer from blocks 2017-10-16 21:00:40 +01:00
sch_api.c net: sched: using kfree_rcu() to simplify the code 2019-02-18 16:34:51 -08:00
sch_atm.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_blackhole.c net_sched: blackhole: tell upper qdisc about dropped packets 2018-06-17 08:42:33 +09:00
sch_cake.c sch_cake: Simplify logic in cake_select_tin() 2019-03-03 20:14:28 -08:00
sch_cbq.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_cbs.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_choke.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_codel.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_drr.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_dsmark.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_etf.c etf: Drop all expired packets 2018-11-16 20:39:34 -08:00
sch_fifo.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_fq.c net_sched: sch_fq: avoid calling ktime_get_ns() if not needed 2018-11-20 09:51:32 -08:00
sch_fq_codel.c net: Add and use skb_mark_not_on_list(). 2018-09-10 10:06:54 -07:00
sch_generic.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-03-04 13:26:15 -08:00
sch_gred.c net: sched: gred: support reporting stats from offloads 2018-11-19 18:53:46 -08:00
sch_hfsc.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_hhf.c net: Add and use skb_mark_not_on_list(). 2018-09-10 10:06:54 -07:00
sch_htb.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_ingress.c net: sched: allow ingress and clsact qdiscs to share filter blocks 2018-01-17 14:53:57 -05:00
sch_mq.c net: sched: mq: offload a graft notification 2018-11-14 08:51:28 -08:00
sch_mqprio.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_multiq.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_netem.c net: netem: fix skb length BUG_ON in __skb_to_sgvec 2019-02-28 10:31:31 -08:00
sch_pie.c net: sched: pie: avoid slow division in drop probability decay 2019-02-28 10:35:41 -08:00
sch_plug.c net: sched: sch: add extack for change qdisc ops 2017-12-21 12:32:50 -05:00
sch_prio.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_qfq.c sched: Fix detection of empty queues in child qdiscs 2019-01-15 20:12:00 -08:00
sch_red.c net: sched: red: notify drivers about RED's limit parameter 2018-11-14 08:51:28 -08:00
sch_sfb.c net: sched: rename qdisc_destroy() to qdisc_put() 2018-09-25 20:17:35 -07:00
sch_sfq.c net: sch: api: add extack support in tcf_block_get 2017-12-21 12:32:51 -05:00
sch_skbprio.c net/sched: add skbprio scheduler 2018-07-24 14:44:00 -07:00
sch_taprio.c tc: Add support for configuring the taprio scheduler 2018-10-04 13:52:23 -07:00
sch_tbf.c sched: Avoid dereferencing skb pointer after child enqueue 2019-01-15 20:12:00 -08:00
sch_teql.c net: sched: sch: add extack for init callback 2017-12-21 12:32:50 -05:00