From 90aafa084597f886533445325239fc84b762391b Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Sat, 16 Apr 2022 07:27:56 +0000 Subject: [PATCH] net_sched: fix a crash in tc_new_tfilter() stable inclusion from linux-4.19.221 commit f9ff09e266ca70c801b9911280f6ae64c9183d85 category: bugfix CVE: CVE-2021-39713 -------------------------------- commit 460b360104d51552a57f39e54b2589c9fd7fa0b3 upstream. When tcf_block_find() fails, it already rollbacks the qdisc refcnt, so its caller doesn't need to clean up this again. Avoid calling qdisc_put() again by resetting qdisc to NULL for callers. Reported-by: syzbot+37b8770e6d5a8220a039@syzkaller.appspotmail.com Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock") Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Zhengchao Shao Conflict: net/sched/cls_api.c Reviewed-by: Xiu Jianfeng Reviewed-by: Wei Yongjun Signed-off-by: Yongqiang Liu --- net/sched/cls_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index ff05f08010c0..3ca18e3a2be9 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -629,8 +629,10 @@ static struct tcf_block *tcf_block_find(struct net *net, struct Qdisc **q, errout_rcu: rcu_read_unlock(); errout_qdisc: - if (*q) + if (*q) { qdisc_destroy(*q); + *q = NULL; + } return ERR_PTR(err); } -- GitLab