提交 460b3601 编写于 作者: C Cong Wang 提交者: David S. Miller

net_sched: fix a crash in tc_new_tfilter()

When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.

Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com
Fixes: e368fdb6 ("net: sched: use Qdisc rcu API instead of relying on rtnl lock")
Signed-off-by: NCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 a1fa8080
......@@ -717,8 +717,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q,
errout_rcu:
rcu_read_unlock();
errout_qdisc:
if (*q)
if (*q) {
qdisc_put(*q);
*q = NULL;
}
return ERR_PTR(err);
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册