diff options
| author | David S. Miller <davem@davemloft.net> | 2017-11-03 10:30:39 +0900 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-11-03 10:30:39 +0900 |
| commit | 2f2b1ae24ce69c7cb03f80a2b77dfd3f9d164626 (patch) | |
| tree | e774e0c77b5f8a2979794ed08cc93b6365852114 /include | |
| parent | 74784da82ff74379d0583a3ffe42835888705ac7 (diff) | |
| parent | ceffcc5e254b450e6159f173e4538215cebf1b59 (diff) | |
| download | linux-2f2b1ae24ce69c7cb03f80a2b77dfd3f9d164626.tar.gz linux-2f2b1ae24ce69c7cb03f80a2b77dfd3f9d164626.tar.bz2 linux-2f2b1ae24ce69c7cb03f80a2b77dfd3f9d164626.zip | |
Merge branch 'net-sched-use-after-free'
Cong Wang says:
====================
net_sched: fix a use-after-free for tc actions
This patchset fixes a use-after-free reported by Lucas
and closes potential races too.
Please see each patch for details.
====================
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/act_api.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/include/net/act_api.h b/include/net/act_api.h index b944e0eb93be..c68551255032 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -13,6 +13,7 @@ struct tcf_idrinfo { spinlock_t lock; struct idr action_idr; + struct net *net; }; struct tc_action_ops; @@ -104,7 +105,7 @@ struct tc_action_net { static inline int tc_action_net_init(struct tc_action_net *tn, - const struct tc_action_ops *ops) + const struct tc_action_ops *ops, struct net *net) { int err = 0; @@ -112,6 +113,7 @@ int tc_action_net_init(struct tc_action_net *tn, if (!tn->idrinfo) return -ENOMEM; tn->ops = ops; + tn->idrinfo->net = net; spin_lock_init(&tn->idrinfo->lock); idr_init(&tn->idrinfo->action_idr); return err; @@ -122,7 +124,9 @@ void tcf_idrinfo_destroy(const struct tc_action_ops *ops, static inline void tc_action_net_exit(struct tc_action_net *tn) { + rtnl_lock(); tcf_idrinfo_destroy(tn->ops, tn->idrinfo); + rtnl_unlock(); kfree(tn->idrinfo); } |