• Cong Wang's avatar
    net_sched: fix a race condition in tcindex_destroy() · 3bf6ec8e
    Cong Wang authored
    [ Upstream commit 8015d93e ]
    
    tcindex_destroy() invokes tcindex_destroy_element() via
    a walker to delete each filter result in its perfect hash
    table, and tcindex_destroy_element() calls tcindex_delete()
    which schedules tcf RCU works to do the final deletion work.
    Unfortunately this races with the RCU callback
    __tcindex_destroy(), which could lead to use-after-free as
    reported by Adrian.
    
    Fix this by migrating this RCU callback to tcf RCU work too,
    as that workqueue is ordered, we will not have use-after-free.
    
    Note, we don't need to hold netns refcnt because we don't call
    tcf_exts_destroy() here.
    
    Fixes: 27ce4f05 ("net_sched: use tcf_queue_work() in tcindex filter")
    Reported-by: 's avatarAdrian <bugs@abtelecom.ro>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: 's avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    3bf6ec8e
Name
Last commit
Last update
Documentation Loading commit data...
LICENSES Loading commit data...
arch Loading commit data...
block Loading commit data...
certs Loading commit data...
crypto Loading commit data...
drivers Loading commit data...
firmware Loading commit data...
fs Loading commit data...
include Loading commit data...
init Loading commit data...
ipc Loading commit data...
kernel Loading commit data...
lib Loading commit data...
mm Loading commit data...
net Loading commit data...
samples Loading commit data...
scripts Loading commit data...
security Loading commit data...
sound Loading commit data...
tools Loading commit data...
usr Loading commit data...
virt Loading commit data...
.clang-format Loading commit data...
.cocciconfig Loading commit data...
.get_maintainer.ignore Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
COPYING Loading commit data...
CREDITS Loading commit data...
Kbuild Loading commit data...
Kconfig Loading commit data...
MAINTAINERS Loading commit data...
Makefile Loading commit data...
README Loading commit data...