diff mbox series

net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed

Message ID 1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn (mailing list archive)
State Accepted
Commit c66070125837900163b81a03063ddd657a7e9bfb
Delegated to: Netdev Maintainers
Headers show
Series net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Guessed tree name to be net-next
netdev/subject_prefix warning Target tree name not specified in the subject
netdev/cc_maintainers success CCed 6 of 6 maintainers
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 8 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link

Commit Message

Xiyu Yang Aug. 29, 2021, 3:58 p.m. UTC
The reference counting issue happens in one exception handling path of
cbq_change_class(). When failing to get tcf_block, the function forgets
to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
causing a refcount leak.

Fix this issue by jumping to "failure" label when get tcf_block failed.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
---
 net/sched/sch_cbq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Jakub Kicinski Aug. 30, 2021, 6:05 p.m. UTC | #1
On Sun, 29 Aug 2021 23:58:01 +0800 Xiyu Yang wrote:
> The reference counting issue happens in one exception handling path of
> cbq_change_class(). When failing to get tcf_block, the function forgets
> to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
> causing a refcount leak.
> 
> Fix this issue by jumping to "failure" label when get tcf_block failed.
> 
> Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>

Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
Cong Wang Aug. 31, 2021, 1:18 a.m. UTC | #2
On Mon, Aug 30, 2021 at 11:05 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Sun, 29 Aug 2021 23:58:01 +0800 Xiyu Yang wrote:
> > The reference counting issue happens in one exception handling path of
> > cbq_change_class(). When failing to get tcf_block, the function forgets
> > to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
> > causing a refcount leak.
> >
> > Fix this issue by jumping to "failure" label when get tcf_block failed.
> >
> > Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
>
> Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")

Reviewed-by: Cong Wang <cong.wang@bytedance.com>

Thanks.
patchwork-bot+netdevbpf@kernel.org Aug. 31, 2021, 3:40 a.m. UTC | #3
Hello:

This patch was applied to netdev/net-next.git (refs/heads/master):

On Sun, 29 Aug 2021 23:58:01 +0800 you wrote:
> The reference counting issue happens in one exception handling path of
> cbq_change_class(). When failing to get tcf_block, the function forgets
> to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
> causing a refcount leak.
> 
> Fix this issue by jumping to "failure" label when get tcf_block failed.
> 
> [...]

Here is the summary with links:
  - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
    https://git.kernel.org/netdev/net-next/c/c66070125837

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index b79a7e27bb31..38a3a8394bbd 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1614,7 +1614,7 @@  cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 	err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
 	if (err) {
 		kfree(cl);
-		return err;
+		goto failure;
 	}
 
 	if (tca[TCA_RATE]) {