From: Eric Dumazet edumazet@google.com
stable inclusion from stable-v4.19.240 commit acff67727dff061f107def4c8c08bacde20d0d40 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JNFK CVE: NA
--------------------------------
[ Upstream commit ec5b0f605b105457f257f2870acad4a5d463984b ]
While investigating a related syzbot report, I found that whenever call to tcf_exts_init() from u32_init_knode() is failing, we end up with an elevated refcount on ht->refcnt
To avoid that, only increase the refcount after all possible errors have been evaluated.
Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()") Signed-off-by: Eric Dumazet edumazet@google.com Cc: Cong Wang xiyou.wangcong@gmail.com Cc: Jiri Pirko jiri@resnulli.us Acked-by: Jamal Hadi Salim jhs@mojatatu.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Lu Wei luwei32@huawei.com Reviewed-by: Yue Haibing yuehaibing@huawei.com Reviewed-by: Wei Yongjun weiyongjun1@huawei.com Signed-off-by: Yongqiang Liu liuyongqiang13@huawei.com --- net/sched/cls_u32.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 205c194bdca0..23d95db99121 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -877,10 +877,6 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, new->flags = n->flags; RCU_INIT_POINTER(new->ht_down, ht);
- /* bump reference count as long as we hold pointer to structure */ - if (ht) - ht->refcnt++; - #ifdef CONFIG_CLS_U32_PERF /* Statistics may be incremented by readers during update * so we must keep them in tact. When the node is later destroyed @@ -903,6 +899,10 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, return NULL; }
+ /* bump reference count as long as we hold pointer to structure */ + if (ht) + ht->refcnt++; + return new; }