net: sched: fix clsact init error path

Since in qdisc_create, the destroy op is called when init fails, we
don't do cleanup in init and leave it up to destroy.
This fixes use-after-free when trying to put already freed block.

Fixes: 6e40cf2d4dee ("net: sched: use extended variants of block_get/put in ingress and clsact qdiscs")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index f40256a3e7f0470f9bdbbf3d27bbb3129595f37b..b91ea03e3afa717225c00a3d2a03e9d722229fbc 100644 (file)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -351,6 +351,8 @@ void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q,
 {
        struct tcf_chain *chain;
 
+       if (!block)
+               return;
        /* Hold a refcnt for all chains, except 0, so that they don't disappear
         * while we are iterating.
         */
@@ -377,8 +379,6 @@ void tcf_block_put(struct tcf_block *block)
 {
        struct tcf_block_ext_info ei = {0, };
 
-       if (!block)
-               return;
        tcf_block_put_ext(block, block->q, &ei);
 }
 

diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 5ecc38f35d4774fdfa402d9a4c4a0e655e1c91c2..5e1cd2e5df87c6dc30cdcb22dc5a1f8b4179a8ef 100644 (file)
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -190,7 +190,7 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
 
        err = tcf_block_get_ext(&q->egress_block, sch, &q->egress_block_info);
        if (err)
-               goto err_egress_block_get;
+               return err;
 
        net_inc_ingress_queue();
        net_inc_egress_queue();
@@ -198,10 +198,6 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt)
        sch->flags |= TCQ_F_CPUSTATS;
 
        return 0;
-
-err_egress_block_get:
-       tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
-       return err;
 }
 
 static void clsact_destroy(struct Qdisc *sch)