netdev - Re: [PATCH net-next v6 08/11] net: sched: don't release reference on action overwrite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpV3ftNR6H0CEXQ01T08WTWNig3xcLxSi7joV+W6atAamA@mail.gmail.com>
Date:   Mon, 13 Aug 2018 16:00:05 -0700
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Vlad Buslov <vladbu@...lanox.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Jiri Pirko <jiri@...nulli.us>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Yevgeny Kliteynik <kliteyn@...lanox.com>,
        Jiri Pirko <jiri@...lanox.com>
Subject: Re: [PATCH net-next v6 08/11] net: sched: don't release reference on
 action overwrite

On Thu, Jul 5, 2018 at 7:24 AM Vlad Buslov <vladbu@...lanox.com> wrote:
> diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
> index 89a761395c94..acea3feae762 100644
> --- a/net/sched/act_ife.c
> +++ b/net/sched/act_ife.c
...
> @@ -548,6 +546,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
>
>                         if (exists)
>                                 spin_unlock_bh(&ife->tcf_lock);
> +                       tcf_idr_release(*a, bind);
> +
>                         kfree(p);
>                         return err;
>                 }

With this change, you seem release it twice when nla_parse_nested() fails
for ACT_P_CREATED case...?

Looks like what you want is the following?

                if (err) {
                        tcf_idr_release(*a, bind);
                        kfree(p);
                        return err;
                }