From mboxrd@z Thu Jan 1 00:00:00 1970 From: Roman Kapl Subject: [PATCH v2] net: sched: fix crash when deleting secondary chains Date: Mon, 20 Nov 2017 22:21:13 +0100 Message-ID: <20171119173632.13125-1-code@rkapl.cz> Cc: Roman Kapl To: netdev@vger.kernel.org Return-path: Received: from droplet.rkapl.cz ([46.101.253.207]:45400 "EHLO droplet.rkapl.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751109AbdKTV2z (ORCPT ); Mon, 20 Nov 2017 16:28:55 -0500 Sender: netdev-owner@vger.kernel.org List-ID: If you flush (delete) a filter chain other than chain 0 (such as when deleting the device), the kernel may run into a use-after-free. The chain refcount must not be decremented unless we are sure we are done with the chain. To reproduce the bug, run: ip link add dtest type dummy tc qdisc add dev dtest ingress tc filter add dev dtest chain 1 parent ffff: flower ip link del dtest Introduced in: commit f93e1cdcf42c ("net/sched: fix filter flushing"), but unless you have KAsan or luck, you won't notice it until commit 0dadc117ac8b ("cls_flower: use tcf_exts_get_net() before call_rcu()") Fixes: f93e1cdcf42c ("net/sched: fix filter flushing") Acked-by: Jiri Pirko Signed-off-by: Roman Kapl --- v1 -> v2: Added Fixes and Acked-by tags The mail was original rejected by vger, this is a re-send to netdev@vger only (with the same message ID). Sorry for any confusion. --- net/sched/cls_api.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index ab255b421781..7d97f612c9b9 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -205,13 +205,14 @@ static void tcf_chain_head_change(struct tcf_chain *chain, static void tcf_chain_flush(struct tcf_chain *chain) { - struct tcf_proto *tp; + struct tcf_proto *tp = rtnl_dereference(chain->filter_chain); tcf_chain_head_change(chain, NULL); - while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) { + while (tp) { RCU_INIT_POINTER(chain->filter_chain, tp->next); - tcf_chain_put(chain); tcf_proto_destroy(tp); + tp = rtnl_dereference(chain->filter_chain); + tcf_chain_put(chain); } } -- 2.15.0