lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 13 Apr 2022 10:35:42 -0700
From:   Eric Dumazet <>
To:     "David S . Miller" <>,
        Jakub Kicinski <>,
        Paolo Abeni <>
Cc:     Jamal Hadi Salim <>,
        Cong Wang <>,
        Jiri Pirko <>, netdev <>,
        Eric Dumazet <>,
        Eric Dumazet <>
Subject: [PATCH net 2/2] net/sched: cls_u32: fix possible leak in u32_init_knode()

From: Eric Dumazet <>

While investigating a related syzbot report,
I found that whenever call to tcf_exts_init()
from u32_init_knode() is failing, we end up
with an elevated refcount on ht->refcnt

To avoid that, only increase the refcount after
all possible errors have been evaluated.

Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()")
Signed-off-by: Eric Dumazet <>
Cc: Jamal Hadi Salim <>
Cc: Cong Wang <>
Cc: Jiri Pirko <>
 net/sched/cls_u32.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index fcba6c43ba509a069c593d525daf2943b4079538..4d27300c287c46d11bf9d44f8c66eded9e734581 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -815,10 +815,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
 	new->flags = n->flags;
 	RCU_INIT_POINTER(new->ht_down, ht);
-	/* bump reference count as long as we hold pointer to structure */
-	if (ht)
-		ht->refcnt++;
 	/* Statistics may be incremented by readers during update
 	 * so we must keep them in tact. When the node is later destroyed
@@ -840,6 +836,10 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp,
 		return NULL;
+	/* bump reference count as long as we hold pointer to structure */
+	if (ht)
+		ht->refcnt++;
 	return new;

Powered by blists - more mailing lists