* [PATCH net] net_sched: act: Delete estimator in error path.
@ 2012-08-06 15:45 Hiroaki SHIMODA
2012-08-06 20:32 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Hiroaki SHIMODA @ 2012-08-06 15:45 UTC (permalink / raw)
To: davem; +Cc: netdev
Some action modules free struct tcf_common in their error path
while estimator is still active. This results in est_timer()
dereference freed memory.
Add gen_kill_estimator() in ipt, pedit and simple action.
Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
---
net/sched/act_ipt.c | 7 ++++++-
net/sched/act_pedit.c | 5 ++++-
net/sched/act_simple.c | 5 ++++-
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60e281a..58fb3c7 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -185,7 +185,12 @@ err3:
err2:
kfree(tname);
err1:
- kfree(pc);
+ if (ret == ACT_P_CREATED) {
+ if (est)
+ gen_kill_estimator(&pc->tcfc_bstats,
+ &pc->tcfc_rate_est);
+ kfree_rcu(pc, tcfc_rcu);
+ }
return err;
}
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 26aa2f6..45c53ab 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -74,7 +74,10 @@ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
p = to_pedit(pc);
keys = kmalloc(ksize, GFP_KERNEL);
if (keys == NULL) {
- kfree(pc);
+ if (est)
+ gen_kill_estimator(&pc->tcfc_bstats,
+ &pc->tcfc_rate_est);
+ kfree_rcu(pc, tcfc_rcu);
return -ENOMEM;
}
ret = ACT_P_CREATED;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 3922f2a..3714f60 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -131,7 +131,10 @@ static int tcf_simp_init(struct nlattr *nla, struct nlattr *est,
d = to_defact(pc);
ret = alloc_defdata(d, defdata);
if (ret < 0) {
- kfree(pc);
+ if (est)
+ gen_kill_estimator(&pc->tcfc_bstats,
+ &pc->tcfc_rate_est);
+ kfree_rcu(pc, tcfc_rcu);
return ret;
}
d->tcf_action = parm->action;
--
1.7.8.6
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] net_sched: act: Delete estimator in error path.
2012-08-06 15:45 [PATCH net] net_sched: act: Delete estimator in error path Hiroaki SHIMODA
@ 2012-08-06 20:32 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2012-08-06 20:32 UTC (permalink / raw)
To: shimoda.hiroaki; +Cc: netdev
From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Date: Tue, 7 Aug 2012 00:45:48 +0900
> Some action modules free struct tcf_common in their error path
> while estimator is still active. This results in est_timer()
> dereference freed memory.
> Add gen_kill_estimator() in ipt, pedit and simple action.
>
> Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-08-06 20:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-08-06 15:45 [PATCH net] net_sched: act: Delete estimator in error path Hiroaki SHIMODA
2012-08-06 20:32 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.