aboutsummaryrefslogtreecommitdiffstats
path: root/net/sched/cls_api.c
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2018-09-27 13:42:19 -0700
committerDavid S. Miller <davem@davemloft.net>2018-10-01 23:09:41 -0700
commit460b360104d51552a57f39e54b2589c9fd7fa0b3 (patch)
tree84082e01896498cde177e058e72e6509786055bf /net/sched/cls_api.c
parentMerge branch 'netlink-extended-attribute-validation' (diff)
downloadlinux-dev-460b360104d51552a57f39e54b2589c9fd7fa0b3.tar.xz
linux-dev-460b360104d51552a57f39e54b2589c9fd7fa0b3.zip
net_sched: fix a crash in tc_new_tfilter()
When tcf_block_find() fails, it already rollbacks the qdisc refcnt, so its caller doesn't need to clean up this again. Avoid calling qdisc_put() again by resetting qdisc to NULL for callers. Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock") Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/cls_api.c')
-rw-r--r--net/sched/cls_api.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3de47e99b788..d670d3066ebd 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -717,8 +717,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q,
errout_rcu:
rcu_read_unlock();
errout_qdisc:
- if (*q)
+ if (*q) {
qdisc_put(*q);
+ *q = NULL;
+ }
return ERR_PTR(err);
}