From: Eric Dumazet Date: Wed, 13 Apr 2022 17:35:42 +0000 (-0700) Subject: net/sched: cls_u32: fix possible leak in u32_init_knode() X-Git-Tag: v6.1-rc5~1528^2~15^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ec5b0f605b105457f257f2870acad4a5d463984b;p=platform%2Fkernel%2Flinux-starfive.git net/sched: cls_u32: fix possible leak in u32_init_knode() While investigating a related syzbot report, I found that whenever call to tcf_exts_init() from u32_init_knode() is failing, we end up with an elevated refcount on ht->refcnt To avoid that, only increase the refcount after all possible errors have been evaluated. Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()") Signed-off-by: Eric Dumazet Cc: Cong Wang Cc: Jiri Pirko Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski --- diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index fcba6c4..4d27300 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -815,10 +815,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, new->flags = n->flags; RCU_INIT_POINTER(new->ht_down, ht); - /* bump reference count as long as we hold pointer to structure */ - if (ht) - ht->refcnt++; - #ifdef CONFIG_CLS_U32_PERF /* Statistics may be incremented by readers during update * so we must keep them in tact. When the node is later destroyed @@ -840,6 +836,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, return NULL; } + /* bump reference count as long as we hold pointer to structure */ + if (ht) + ht->refcnt++; + return new; }