| Message ID | 8f12357dd5131d64326b05ac5b71eb847afb692a.1550834944.git.dcaratti@redhat.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] net/sched: act_skbedit: fix refcount leak when replace fails | expand |
From: Davide Caratti <dcaratti@redhat.com> Date: Fri, 22 Feb 2019 12:33:26 +0100 > when act_skbedit was converted to use RCU in the data plane, we added an > error path, but we forgot to drop the action refcount in case of failure > during a 'replace' operation: > > # tc actions add action skbedit ptype otherhost pass index 100 > # tc action show action skbedit > total acts 1 > > action order 0: skbedit ptype otherhost pass > index 100 ref 1 bind 0 > # tc actions replace action skbedit ptype otherhost drop index 100 > RTNETLINK answers: Cannot allocate memory > We have an error talking to the kernel > # tc action show action skbedit > total acts 1 > > action order 0: skbedit ptype otherhost pass > index 100 ref 2 bind 0 > > Ensure we call tcf_idr_release(), in case 'params_new' allocation failed, > also when the action is being replaced. > > Fixes: c749cdda9089 ("net/sched: act_skbedit: don't use spinlock in the data path") > Signed-off-by: Davide Caratti <dcaratti@redhat.com> Also applied and queued up for -stable.
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c index 64dba3708fce..cfceed28c333 100644 --- a/net/sched/act_skbedit.c +++ b/net/sched/act_skbedit.c @@ -189,8 +189,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, params_new = kzalloc(sizeof(*params_new), GFP_KERNEL); if (unlikely(!params_new)) { - if (ret == ACT_P_CREATED) - tcf_idr_release(*a, bind); + tcf_idr_release(*a, bind); return -ENOMEM; }
when act_skbedit was converted to use RCU in the data plane, we added an error path, but we forgot to drop the action refcount in case of failure during a 'replace' operation: # tc actions add action skbedit ptype otherhost pass index 100 # tc action show action skbedit total acts 1 action order 0: skbedit ptype otherhost pass index 100 ref 1 bind 0 # tc actions replace action skbedit ptype otherhost drop index 100 RTNETLINK answers: Cannot allocate memory We have an error talking to the kernel # tc action show action skbedit total acts 1 action order 0: skbedit ptype otherhost pass index 100 ref 2 bind 0 Ensure we call tcf_idr_release(), in case 'params_new' allocation failed, also when the action is being replaced. Fixes: c749cdda9089 ("net/sched: act_skbedit: don't use spinlock in the data path") Signed-off-by: Davide Caratti <dcaratti@redhat.com> --- net/sched/act_skbedit.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)