From patchwork Mon Feb 4 14:50:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Petr Machata X-Patchwork-Id: 1035975 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=mellanox.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=Mellanox.com header.i=@Mellanox.com header.b="M/Rpt1pB"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43tVxw5ZcZz9s3l for ; Tue, 5 Feb 2019 01:50:44 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728357AbfBDOum (ORCPT ); Mon, 4 Feb 2019 09:50:42 -0500 Received: from mail-eopbgr60058.outbound.protection.outlook.com ([40.107.6.58]:6880 "EHLO EUR04-DB3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725992AbfBDOum (ORCPT ); Mon, 4 Feb 2019 09:50:42 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Mellanox.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GcXgjsApp/nfqmh4+3Dk48/alfyBYpJ7cAPRCJcF5iQ=; b=M/Rpt1pBmmkvxTeHo3q8bN79K/iAeD8qxNwzFvI1LQ9QcgretA81fPq1ByoYNXoNVuFSyeK11ILIaIMy6ENC2gqdeNbCGiECWGOqJsr+5gziV2qdfT+lBDWYVcItzPsIpaITAxdpYDldZpwIRwE3TOV5LXSMZttG14XyWE9XJXI= Received: from VI1PR05MB3247.eurprd05.prod.outlook.com (10.170.238.16) by VI1PR05MB4590.eurprd05.prod.outlook.com (20.176.3.31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1580.20; Mon, 4 Feb 2019 14:50:38 +0000 Received: from VI1PR05MB3247.eurprd05.prod.outlook.com ([fe80::210b:6763:af21:4f43]) by VI1PR05MB3247.eurprd05.prod.outlook.com ([fe80::210b:6763:af21:4f43%5]) with mapi id 15.20.1580.019; Mon, 4 Feb 2019 14:50:38 +0000 From: Petr Machata To: "netdev@vger.kernel.org" CC: "jhs@mojatatu.com" , "xiyou.wangcong@gmail.com" , "jiri@resnulli.us" , Ido Schimmel , Paul Blakey , "davem@davemloft.net" Subject: [PATCH net] net: cls_flower: Remove filter from mask before freeing it Thread-Topic: [PATCH net] net: cls_flower: Remove filter from mask before freeing it Thread-Index: AQHUvJj+G7XnpZ0Uskmjt8HPs/YIKA== Date: Mon, 4 Feb 2019 14:50:38 +0000 Message-ID: <6f8e5a3f3ad2d6bc2f5a81ce1be1167b8aa456df.1549291065.git.petrm@mellanox.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: AM6P193CA0049.EURP193.PROD.OUTLOOK.COM (2603:10a6:209:8e::26) To VI1PR05MB3247.eurprd05.prod.outlook.com (2603:10a6:802:1c::16) authentication-results: spf=none (sender IP is ) smtp.mailfrom=petrm@mellanox.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [78.45.160.211] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR05MB4590; 6:gT0DC150sRgzOeul6ZLDCwKa0q7e9rYDCuOR1/GE0IsIqnb1Wjl9z3K4E9uWSIeohinlhgaTHQbRPLyA37NysvXbWMaB9UtqyVmK0hsvJVY4/H3cPiAZO6muTfWKiUVGoISAELdTfKJsJL+YUb4si65S6Jj0qS7TWHUdIsDDcwRphUAtccyO8HUWBM/dsN29kU+fjdn2990XxkAHKwPELmt/b7k1wAfIn8xgmvDIBWRQ2HoPUyWeNv+EBCpSzNZdvfZ7W9asSSE9ncWt60TBVS8IeE8KAviD91fM+BpILUMne1XoRbnsethnUqUfh1GK+/CJUDjKISXT0hZfx9JEmudaSfgPWOUdPlHO0xG+8eEHxfK9NOC0e5qedWcjMKZPm+xKQnvvId11WV6xZ7TjkobNOiYjAqBKiJ+FfgBgtkqTJL0EDzcUtFL8tATj/lyuHuWyIDio9HW3fm9A8vTevw==; 5:YXYgtoNwotPBm7yXOpuwO3xMDlud5LEZl/n6M7Ifh03IZTmSEFhV7gYBvyfi6Ce3ggSiNwLeEBTW4w76skNW4dEHsdCFkm8wx4M8IlK+yhdOn3rTo7kYOG3T8SFTIbR8rbCRyGN3k12EUuu8K1Vm6ys7DqT7kZ4GyE0yKgGqfuUJxnsyi+hRBhDW2jk22ZHrJxU0xnTSQ9RcdbnSqeaEKw==; 7:TYvjx7MwpzUlALYN9mR5+xSXj2pJvdX3MIkv/67Ag+wNum9yv/+BrT5+cggmCF2aFPxR0f0s34ueD1+iklgE9J1G4SSVJi5lX1JnIzwj2yY8ya0J0l5F+psRXvvNPZRVn81G+yzwpqDfHddAadL4iw== x-ms-office365-filtering-correlation-id: 2b8b9c7b-a3ed-4d0a-bdb0-08d68ab02074 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600110)(711020)(4605077)(4618075)(2017052603328)(7153060)(7193020); SRVR:VI1PR05MB4590; x-ms-traffictypediagnostic: VI1PR05MB4590: x-microsoft-antispam-prvs: x-forefront-prvs: 0938781D02 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(136003)(376002)(39860400002)(366004)(396003)(199004)(189003)(305945005)(14454004)(71190400001)(71200400001)(2616005)(476003)(68736007)(486006)(118296001)(6916009)(106356001)(39060400002)(99286004)(478600001)(52116002)(186003)(2351001)(86362001)(2501003)(6486002)(36756003)(81166006)(5640700003)(8676002)(1730700003)(6436002)(81156014)(26005)(3846002)(66066001)(8936002)(7736002)(6116002)(4326008)(105586002)(25786009)(2906002)(54906003)(97736004)(316002)(386003)(102836004)(6506007)(256004)(53936002)(6512007)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR05MB4590; H:VI1PR05MB3247.eurprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: mellanox.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 3iBMqKMN+r7rUDPoYbiXQ5x9NymM0z3UCDGn6KMJgCN2nt7JnOhzRQvVnk/XnV3hHG2EUZ1gI1VD2uFLqNwdZfDHNYvJbApiPyhFA08tVtI2msQWVd3eeRE6zxHGWEAiWvh6M7rIewjcdA1QfIhOJHiOa8gTeUBGk9hc01hkKCOShASHHE0+3wacEiYc5ECYrE8hf8eCbCsmyNHeFxrEyhA9gGxkHrkRxxnnIVYBO8dGqDUN/K5U77QsKxhqe2MNUU3F6kabThhegs6yzGNuHs1SavcJzY1+sdZCctFDNwo0vnCwaN2shkuqFwuZH+MlIEezI296QYZBAkl0DdIEx6ODDgeKg4aA3kl/XLvacmnuMU1M1+llRwSN8hvANrhr/bUnZfQPlLnAH1kbl3NRpO1hWjj87usYOwq75zc4FjU= MIME-Version: 1.0 X-OriginatorOrg: Mellanox.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2b8b9c7b-a3ed-4d0a-bdb0-08d68ab02074 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Feb 2019 14:50:37.8389 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-id: a652971c-7d2e-4d9b-a6a4-d149256f461b X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR05MB4590 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In fl_change(), when adding a new rule (i.e. fold == NULL), a driver may reject the new rule, for example due to resource exhaustion. By that point, the new rule was already assigned a mask, and it was added to that mask's hash table. The clean-up path that's invoked as a result of the rejection however neglects to undo the hash table addition, and proceeds to free the new rule, thus leaving a dangling pointer in the hash table. Fix by removing fnew from the mask's hash table before it is freed. Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules also under skip_sw") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Reviewed-by: Ido Schimmel --- Notes: Note that this is covered by mirror_gre_scale test in tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh net/sched/cls_flower.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index f6aa57fbbbaf..12ca9d13db83 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -1371,7 +1371,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, if (!tc_skip_hw(fnew->flags)) { err = fl_hw_replace_filter(tp, fnew, extack); if (err) - goto errout_mask; + goto errout_mask_ht; } if (!tc_in_hw(fnew->flags)) @@ -1401,6 +1401,10 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, kfree(mask); return 0; +errout_mask_ht: + rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node, + fnew->mask->filter_ht_params); + errout_mask: fl_mask_put(head, fnew->mask, false);