Commit 12186be7 authored by Minoru Usui's avatar Minoru Usui Committed by David S. Miller
Browse files

net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel...

net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup

This patch fixes a bug which unconfigured struct tcf_proto keeps
chaining in tc_ctl_tfilter(), and avoids kernel panic in
cls_cgroup_classify() when we use cls_cgroup.

When we execute 'tc filter add', tcf_proto is allocated, initialized
by classifier's init(), and chained.  After it's chained,
tc_ctl_tfilter() calls classifier's change().  When classifier's
change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto.

In addition, cls_cgroup is initialized in change() not in init().  It
accesses unconfigured struct tcf_proto which is chained before
change(), then hits Oops.
Signed-off-by: default avatarMinoru Usui <>
Signed-off-by: default avatarJarek Poplawski <>
Signed-off-by: default avatarJamal Hadi Salim <>
Tested-by: default avatarMinoru Usui <>
Signed-off-by: default avatarDavid S. Miller <>
parent ea30e119
......@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
unsigned long cl;
unsigned long fh;
int err;
int tp_created = 0;
if (net != &init_net)
return -EINVAL;
......@@ -266,10 +267,7 @@ replay:
goto errout;
tp->next = *back;
*back = tp;
tp_created = 1;
} else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
goto errout;
......@@ -296,8 +294,11 @@ replay:
switch (n->nlmsg_type) {
err = -EEXIST;
if (n->nlmsg_flags & NLM_F_EXCL)
if (n->nlmsg_flags & NLM_F_EXCL) {
if (tp_created)
goto errout;
err = tp->ops->delete(tp, fh);
......@@ -314,8 +315,18 @@ replay:
err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
if (err == 0)
if (err == 0) {
if (tp_created) {
tp->next = *back;
*back = tp;
tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
} else {
if (tp_created)
if (cl)
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment