diff options
| author | Vlad Buslov <vladbu@mellanox.com> | 2018-08-14 20:29:56 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-08-16 12:12:12 -0700 |
| commit | 32039eac4c48f70dfaad36a84f30356ededc7ea8 (patch) | |
| tree | e032ecc8fe44d5c4534999e5bdd97e1cced66080 | |
| parent | 5f34f69ede27dea1f167a0a6d8996f0194b27ba8 (diff) | |
| download | syzbot-bug-32039eac4c48f70dfaad36a84f30356ededc7ea8.tar.gz | |
net: sched: act_ife: always release ife action on init error
Action init API was changed to always take reference to action, even when
overwriting existing action. Substitute conditional action release, which
was executed only if action is newly created, with unconditional release in
tcf_ife_init() error handling code to prevent double free or memory leak in
case of overwrite.
Fixes: 4e8ddd7f1758 ("net: sched: don't release reference on action overwrite")
Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/act_ife.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index fdb928ca81bb7e..d1081bdf1bdb55 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -551,9 +551,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla, NULL, NULL); if (err) { metadata_parse_err: - if (ret == ACT_P_CREATED) - tcf_idr_release(*a, bind); - if (exists) spin_unlock_bh(&ife->tcf_lock); tcf_idr_release(*a, bind); @@ -574,11 +571,10 @@ metadata_parse_err: */ err = use_all_metadata(ife); if (err) { - if (ret == ACT_P_CREATED) - tcf_idr_release(*a, bind); - if (exists) spin_unlock_bh(&ife->tcf_lock); + tcf_idr_release(*a, bind); + kfree(p); return err; } |