net: sched: act_sample: fix psample group handling on overwrite
[ Upstream commit dbf47a2a094edf58983265e323ca4bdcdb58b5ee ]
Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:
- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
s->psample_group, even though we neither setting the pointer to NULL, nor
preventing concurrent readers from accessing the pointer in some way.
Use rcu_swap_protected() instead to safely reset the pointer.
- Old value of s->psample_group is not released or deallocated in any way,
which results resource leak. Use psample_group_put() on non-NULL value
obtained with rcu_swap_protected().
- The function psample_group_put() that released reference to struct
psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
grace period when deallocating it. Extend struct psample_group with rcu
head and use kfree_rcu when freeing it.
Fixes: 5c5670fae4
("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
6a2bd82616
commit
5ff0ab0c66
3 changed files with 6 additions and 2 deletions
|
@ -12,6 +12,7 @@ struct psample_group {
|
||||||
u32 group_num;
|
u32 group_num;
|
||||||
u32 refcount;
|
u32 refcount;
|
||||||
u32 seq;
|
u32 seq;
|
||||||
|
struct rcu_head rcu;
|
||||||
};
|
};
|
||||||
|
|
||||||
struct psample_group *psample_group_get(struct net *net, u32 group_num);
|
struct psample_group *psample_group_get(struct net *net, u32 group_num);
|
||||||
|
|
|
@ -156,7 +156,7 @@ static void psample_group_destroy(struct psample_group *group)
|
||||||
{
|
{
|
||||||
psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
|
psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
|
||||||
list_del(&group->list);
|
list_del(&group->list);
|
||||||
kfree(group);
|
kfree_rcu(group, rcu);
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct psample_group *
|
static struct psample_group *
|
||||||
|
|
|
@ -99,7 +99,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
|
||||||
s->tcf_action = parm->action;
|
s->tcf_action = parm->action;
|
||||||
s->rate = rate;
|
s->rate = rate;
|
||||||
s->psample_group_num = psample_group_num;
|
s->psample_group_num = psample_group_num;
|
||||||
RCU_INIT_POINTER(s->psample_group, psample_group);
|
rcu_swap_protected(s->psample_group, psample_group,
|
||||||
|
lockdep_is_held(&s->tcf_lock));
|
||||||
|
|
||||||
if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
|
if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
|
||||||
s->truncate = true;
|
s->truncate = true;
|
||||||
|
@ -107,6 +108,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
|
||||||
}
|
}
|
||||||
spin_unlock_bh(&s->tcf_lock);
|
spin_unlock_bh(&s->tcf_lock);
|
||||||
|
|
||||||
|
if (psample_group)
|
||||||
|
psample_group_put(psample_group);
|
||||||
if (ret == ACT_P_CREATED)
|
if (ret == ACT_P_CREATED)
|
||||||
tcf_idr_insert(tn, *a);
|
tcf_idr_insert(tn, *a);
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue