[RHEL7,COMMIT] ms/net_sched: cls_route: remove the right filter from hashtable

Submitted by Konstantin Khorenko on May 21, 2020, 9:50 a.m.


Message ID 202005210950.04L9oxFa009776@finist-ce7.sw.ru
State New
Series "ms/net_sched: cls_route: remove the right filter from hashtable"
Headers show

Commit Message

Konstantin Khorenko May 21, 2020, 9:50 a.m.
The commit is pushed to "branch-rh7-3.10.0-1127.8.2.vz7.151.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.8.2.vz7.151.3
commit bbb79af77a24fbb7dbe9ef26b4d536c5a7abfe38
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date:   Fri Mar 13 22:29:54 2020 -0700

    ms/net_sched: cls_route: remove the right filter from hashtable
    route4_change() allocates a new filter and copies values from
    the old one. After the new filter is inserted into the hash
    table, the old filter should be removed and freed, as the final
    step of the update.
    However, the current code mistakenly removes the new one. This
    looks apparently wrong to me, and it causes double "free" and
    use-after-free too, as reported by syzbot.
    Reported-and-tested-by: syzbot+f9b32aaacd60305d9687@syzkaller.appspotmail.com
    Reported-and-tested-by: syzbot+2f8c233f131943d6056d@syzkaller.appspotmail.com
    Reported-and-tested-by: syzbot+9c2df9fd5e9445b74e01@syzkaller.appspotmail.com
    Fixes: 1109c00547fc ("net: sched: RCU cls_route")
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Cc: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    (cherry picked from commit ef299cc3fa1a9e1288665a9fdc8bff55629fd359)
    Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
 net/sched/cls_route.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch hide | download patch | download mbox

diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 7bd464e8d084b..2fed29fa504e4 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -534,8 +534,8 @@  static int route4_change(struct net *net, struct sk_buff *in_skb,
 			fp = &b->ht[h];
 			for (pfp = rtnl_dereference(*fp); pfp;
 			     fp = &pfp->next, pfp = rtnl_dereference(*fp)) {
-				if (pfp == f) {
-					*fp = f->next;
+				if (pfp == fold) {
+					rcu_assign_pointer(*fp, fold->next);