net/sched: cls_u32: Fix reference counter leak leading to overflow
authorLee Jones <lee@kernel.org>
Thu, 8 Jun 2023 07:29:03 +0000 (08:29 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 21 Jun 2023 14:00:59 +0000 (16:00 +0200)
commit07f9cc229b44cbcee6385802d390091d915f38c3
tree739a23ce3ff44c07cbff077b64cb559c27eb94b1
parentc9411f014e5ccd2e3cb2dc8ab96ea6bc76a978f6
net/sched: cls_u32: Fix reference counter leak leading to overflow

[ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ]

In the event of a failure in tcf_change_indev(), u32_set_parms() will
immediately return without decrementing the recently incremented
reference counter.  If this happens enough times, the counter will
rollover and the reference freed, leading to a double free which can be
used to do 'bad things'.

In order to prevent this, move the point of possible failure above the
point where the reference counter is incremented.  Also save any
meaningful return values to be applied to the return data at the
appropriate point in time.

This issue was caught with KASAN.

Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/sched/cls_u32.c