This is a note to let you know that I've just added the patch titled
net_sched: fix a crash in tc_new_tfilter()
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net_sched-fix-a-crash-in-tc_new_tfilter.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 460b360104d51552a57f39e54b2589c9fd7fa0b3 Mon Sep 17 00:00:00 2001
From: Cong Wang <xiyou.wangcong@xxxxxxxxx>
Date: Thu, 27 Sep 2018 13:42:19 -0700
Subject: net_sched: fix a crash in tc_new_tfilter()
From: Cong Wang <xiyou.wangcong@xxxxxxxxx>
commit 460b360104d51552a57f39e54b2589c9fd7fa0b3 upstream.
When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.
Reported-by: syzbot+37b8770e6d5a8220a039@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: Cong Wang <xiyou.wangcong@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/sched/cls_api.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -629,8 +629,10 @@ static struct tcf_block *tcf_block_find(
errout_rcu:
rcu_read_unlock();
errout_qdisc:
- if (*q)
+ if (*q) {
qdisc_put(*q);
+ *q = NULL;
+ }
return ERR_PTR(err);
}
Patches currently in stable-queue which might be from xiyou.wangcong@xxxxxxxxx are
queue-4.19/net_sched-fix-a-crash-in-tc_new_tfilter.patch
