diff options
| author | Jiri Pirko <jiri@mellanox.com> | 2017-12-15 12:40:12 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-12-15 15:43:12 -0500 |
| commit | 343723dd51ef1025a860e54df9472b5ba21ee3d9 (patch) | |
| tree | 6611f40a0342dca4fad113db640e0371471f8f62 /net/sched/sch_ingress.c | |
| parent | c05fad5713b81b049ec6ac4eb2d304030b1efdce (diff) | |
| download | op-kernel-dev-343723dd51ef1025a860e54df9472b5ba21ee3d9.zip op-kernel-dev-343723dd51ef1025a860e54df9472b5ba21ee3d9.tar.gz | |
net: sched: fix clsact init error path
Since in qdisc_create, the destroy op is called when init fails, we
don't do cleanup in init and leave it up to destroy.
This fixes use-after-free when trying to put already freed block.
Fixes: 6e40cf2d4dee ("net: sched: use extended variants of block_get/put in ingress and clsact qdiscs")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_ingress.c')
| -rw-r--r-- | net/sched/sch_ingress.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c index 5ecc38f..5e1cd2e 100644 --- a/net/sched/sch_ingress.c +++ b/net/sched/sch_ingress.c @@ -190,7 +190,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt) err = tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info); if (err) - goto err_egress_block_get; + return err; net_inc_ingress_queue(); net_inc_egress_queue(); @@ -198,10 +198,6 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt) sch->flags |= TCQ_F_CPUSTATS; return 0; - -err_egress_block_get: - tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info); - return err; } static void clsact_destroy(struct Qdisc *sch) |
