diff options
| author |   Vlad Buslov <vladbu@mellanox.com> | 2019-08-27 21:49:38 +0300 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2019-08-28 15:53:51 -0700 |
| commit | dbf47a2a094edf58983265e323ca4bdcdb58b5ee (patch) | |
| tree | 4d67881165f57063cadc0456b7c7e5c8be0b5090 /net/sched/act_connmark.c | |
| parent | ibmvnic: Do not process reset during or after device removal (diff) | |
| download | linux-dev-dbf47a2a094edf58983265e323ca4bdcdb58b5ee.tar.xz linux-dev-dbf47a2a094edf58983265e323ca4bdcdb58b5ee.zip | |
net: sched: act_sample: fix psample group handling on overwrite
Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:
- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
s->psample_group, even though we neither setting the pointer to NULL, nor
preventing concurrent readers from accessing the pointer in some way.
Use rcu_swap_protected() instead to safely reset the pointer.
- Old value of s->psample_group is not released or deallocated in any way,
which results resource leak. Use psample_group_put() on non-NULL value
obtained with rcu_swap_protected().
- The function psample_group_put() that released reference to struct
psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
grace period when deallocating it. Extend struct psample_group with rcu
head and use kfree_rcu when freeing it.
Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/act_connmark.c')
0 files changed, 0 insertions, 0 deletions