提交 275c44aa 编写于 作者: D Davide Caratti 提交者: David S. Miller

net/sched: cls_u32: fix refcount leak in the error path of u32_change()

when users replace cls_u32 filters with new ones having wrong parameters,
so that u32_change() fails to validate them, the kernel doesn't roll-back
correctly, and leaves semi-configured rules.

Fix this in u32_walk(), avoiding a call to the walker function on filters
that don't have a match rule connected. The side effect is, these "empty"
filters are not even dumped when present; but that shouldn't be a problem
as long as we are restoring the original behaviour, where semi-configured
filters were not even added in the error path of u32_change().

Fixes: 6676d5e4 ("net: sched: set dedicated tcf_walker flag when tp is empty")
Signed-off-by: NDavide Caratti <dcaratti@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 615f22f5
......@@ -1108,10 +1108,33 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
return err;
}
static bool u32_hnode_empty(struct tc_u_hnode *ht, bool *non_root_ht)
{
int i;
if (!ht)
return true;
if (!ht->is_root) {
*non_root_ht = true;
return false;
}
if (*non_root_ht)
return false;
if (ht->refcnt < 2)
return true;
for (i = 0; i <= ht->divisor; i++) {
if (rtnl_dereference(ht->ht[i]))
return false;
}
return true;
}
static void u32_walk(struct tcf_proto *tp, struct tcf_walker *arg,
bool rtnl_held)
{
struct tc_u_common *tp_c = tp->data;
bool non_root_ht = false;
struct tc_u_hnode *ht;
struct tc_u_knode *n;
unsigned int h;
......@@ -1124,6 +1147,8 @@ static void u32_walk(struct tcf_proto *tp, struct tcf_walker *arg,
ht = rtnl_dereference(ht->next)) {
if (ht->prio != tp->prio)
continue;
if (u32_hnode_empty(ht, &non_root_ht))
return;
if (arg->count >= arg->skip) {
if (arg->fn(tp, ht, arg) < 0) {
arg->stop = 1;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册