mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
net_sched: fix a use-after-free in tc_ctl_tfilter()
When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.
For long term, we probably should move tp list to list_head.
Fixes: 1e052be69d
("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
1006da19ea
commit
d744318574
1 changed files with 3 additions and 4 deletions
|
@ -308,12 +308,11 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
|
|||
case RTM_DELTFILTER:
|
||||
err = tp->ops->delete(tp, fh);
|
||||
if (err == 0) {
|
||||
tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
|
||||
if (tcf_destroy(tp, false)) {
|
||||
struct tcf_proto *next = rtnl_dereference(tp->next);
|
||||
struct tcf_proto *next = rtnl_dereference(tp->next);
|
||||
|
||||
tfilter_notify(net, skb, n, tp, fh, RTM_DELTFILTER);
|
||||
if (tcf_destroy(tp, false))
|
||||
RCU_INIT_POINTER(*back, next);
|
||||
}
|
||||
}
|
||||
goto errout;
|
||||
case RTM_GETTFILTER:
|
||||
|
|
Loading…
Reference in a new issue