From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net] act_ife: fix a potential use-after-free Date: Mon, 3 Sep 2018 11:08:15 -0700 Message-ID: <20180903180815.32220-1-xiyou.wangcong@gmail.com> Cc: Cong Wang , Jamal Hadi Salim To: netdev@vger.kernel.org Return-path: Received: from mail-pl1-f194.google.com ([209.85.214.194]:38661 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727338AbeICW3n (ORCPT ); Mon, 3 Sep 2018 18:29:43 -0400 Received: by mail-pl1-f194.google.com with SMTP id u11-v6so482880plq.5 for ; Mon, 03 Sep 2018 11:08:24 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: Immediately after module_put(), user could delete this module, so e->ops could be already freed before we call e->ops->release(). Fix this by moving module_put() after ops->release(). Fixes: ef6980b6becb ("introduce IFE action") Cc: Jamal Hadi Salim Signed-off-by: Cong Wang --- net/sched/act_ife.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 196430aefe87..fc412769a1be 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -400,7 +400,6 @@ static void _tcf_ife_cleanup(struct tc_action *a) struct tcf_meta_info *e, *n; list_for_each_entry_safe(e, n, &ife->metalist, metalist) { - module_put(e->ops->owner); list_del(&e->metalist); if (e->metaval) { if (e->ops->release) @@ -408,6 +407,7 @@ static void _tcf_ife_cleanup(struct tc_action *a) else kfree(e->metaval); } + module_put(e->ops->owner); kfree(e); } } -- 2.14.4