From patchwork Tue Sep 3 14:07:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13788750 X-Patchwork-Delegate: kuba@kernel.org Received: from forward100b.mail.yandex.net (forward100b.mail.yandex.net [178.154.239.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D74E81CA68F for ; Tue, 3 Sep 2024 14:08:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.147 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372488; cv=none; b=hPIdkcNnChWG7blOTfwRAYpSMGY2ynieKTRz2k282+4t7PwWF1SjeTSuS5sOzQFhSK7+Tz+4df/SYNLnY351z0dcJOf2ohXDPLFIuNlYaK7E+RDHMC0WBnrbMAlSlpxIurEQv4w769VlhtoWrBSpMdl99ndfURxCJ5Q3D3ILG/w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372488; c=relaxed/simple; bh=Ae/hvkMJYTCa+tGCz1s4pKR8Cou/xrH5zEu3s3q7wys=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=i0rJPaTnq4z/WA3HSPaVI9xe3c14pDH77KM+NVuhStdkRGcCVIZOLYbm02TsidxXDy65GS6RixOqioN8nHc1cs2qVklqsaicpdmWjITtsXCpRFBYV8P1VAh4/qw7uYzwFWoQ9AJFRiVvvb45/gKF3I76kHvI8bIMihDO/loGzhQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=qvRZmoqb; arc=none smtp.client-ip=178.154.239.147 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="qvRZmoqb" Received: from mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:de2c:0:640:e39b:0]) by forward100b.mail.yandex.net (Yandex) with ESMTPS id 59FFB60917; Tue, 3 Sep 2024 17:07:56 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id s7cJDQ0oD0U0-hBMFp44A; Tue, 03 Sep 2024 17:07:55 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1725372475; bh=ITm/G4Xv+muuJ8JRHFHlPRARYyTpD5M0eMX/8qVJhvI=; h=Message-ID:Date:Cc:Subject:To:From; b=qvRZmoqbptTSkALPaC2ald5r0AhG049Y+MM0XioZSbsJy+ouqXFoxIYMhWj6Obp+R BdWPVd/WDapB9LuBR9mSziGo/mUXo5n3nt3uY+T57w2bL0SwMlfbr+nxFJJkGRzL9c 0DNwV/fbsQSV4T4n6bo6tIsSz9AjWuVD14/Lii9k= Authentication-Results: mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Vinicius Costa Gomes Cc: Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, lvc-project@linuxtesting.org, Dmitry Antipov , syzbot+b65e0af58423fc8a73aa@syzkaller.appspotmail.com Subject: [PATCH net v4 1/3] net: sched: fix use-after-free in taprio_change() Date: Tue, 3 Sep 2024 17:07:06 +0300 Message-ID: <20240903140708.3122263-1-dmantipov@yandex.ru> X-Mailer: git-send-email 2.46.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing. Fixes: a3d43c0d56f1 ("taprio: Add support adding an admin schedule") Reported-by: syzbot+b65e0af58423fc8a73aa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa Signed-off-by: Dmitry Antipov --- v4: adjust subject to target net tree v3: unchanged since v2 v2: unchanged since v1 --- net/sched/sch_taprio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index cc2df9f8c14a..59fad74d5ff9 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -1963,7 +1963,8 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, taprio_start_sched(sch, start, new_admin); - rcu_assign_pointer(q->admin_sched, new_admin); + admin = rcu_replace_pointer(q->admin_sched, new_admin, + lockdep_rtnl_is_held()); if (admin) call_rcu(&admin->rcu, taprio_free_sched_cb); From patchwork Tue Sep 3 14:07:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13788755 X-Patchwork-Delegate: kuba@kernel.org Received: from forward200b.mail.yandex.net (forward200b.mail.yandex.net [178.154.239.157]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE8B657CB4 for ; Tue, 3 Sep 2024 14:08:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.157 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372495; cv=none; b=YEgwQyoS+KJ1SsLgBwsf+Bq+CkFPB+GhOhxkNwV+fcTd6x4o5BLTcSqQs5stLlqmofZko8bFpgm8VkDaxzmgQIeToeKcnDUuPLcvr0GyDS2oI9lGoRVHp+AOnw3Io9ZAIuBu2ppT1c8SXMNAcbb1SrIaB+a6wGxSCUjMh2EEy+g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372495; c=relaxed/simple; bh=sfdEppQNSN1c2rO3jyB5PIwQKyNLGuP6QHTw7wgfiE8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UFojSxynFDo8byo4wgUzBOS+fP50j1VJTCkyDEPrB1sA1itSmk1I+Efylu1exQWnQcSwQBnpdmMnUtnVbkx50yvaQZgwuXZRXCI68M/zqIxq48VZBR7+cKjb0IAGjJdDu4bfS6x+hqwDPLiBhYd9ljvh3gnhSYQXNb6M4RlDdc0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=QOCKgKll; arc=none smtp.client-ip=178.154.239.157 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="QOCKgKll" Received: from forward102b.mail.yandex.net (forward102b.mail.yandex.net [IPv6:2a02:6b8:c02:900:1:45:d181:d102]) by forward200b.mail.yandex.net (Yandex) with ESMTPS id E5FD069361 for ; Tue, 3 Sep 2024 17:08:04 +0300 (MSK) Received: from mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:de2c:0:640:e39b:0]) by forward102b.mail.yandex.net (Yandex) with ESMTPS id 30B266099E; Tue, 3 Sep 2024 17:07:57 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id s7cJDQ0oD0U0-EO2OQbfD; Tue, 03 Sep 2024 17:07:56 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1725372476; bh=Y+k/yNn5odf6VBOhy56nGfHS/YiBPMwQZRP4UHiMdxM=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=QOCKgKlllv9EeDd13+J5LN/xfvxBaluqLGLLhl5HR6WPTWKrCyEc41hbfUlpK6+g5 JPICKEkwAx7TnQ1NQay217BdTixP4TxoImZK9OjfO9tGj9mYGTa9V9UJyEtMBwdPnG hJNxlq+91sNFVEf0CAsJImurGyMo6hJwE5Hh4jU8= Authentication-Results: mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Vinicius Costa Gomes Cc: Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, lvc-project@linuxtesting.org, Dmitry Antipov Subject: [PATCH net v4 2/3] net: sched: consistently use rcu_replace_pointer() in taprio_change() Date: Tue, 3 Sep 2024 17:07:07 +0300 Message-ID: <20240903140708.3122263-2-dmantipov@yandex.ru> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240903140708.3122263-1-dmantipov@yandex.ru> References: <20240903140708.3122263-1-dmantipov@yandex.ru> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org According to Vinicius (and carefully looking through the whole thing once again), txtime branch of 'taprio_change()' is not going to race against 'advance_sched()'. But using 'rcu_replace_pointer()' in the former may be a good idea as well. Suggested-by: Vinicius Costa Gomes Signed-off-by: Dmitry Antipov --- v4: adjust subject to target net tree v3: unchanged since v2 v2: added to the series --- net/sched/sch_taprio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 59fad74d5ff9..9f4e004cdb8b 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -1952,7 +1952,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, goto unlock; } - rcu_assign_pointer(q->admin_sched, new_admin); + /* Not going to race against advance_sched(), but still */ + admin = rcu_replace_pointer(q->admin_sched, new_admin, + lockdep_rtnl_is_held()); if (admin) call_rcu(&admin->rcu, taprio_free_sched_cb); } else { From patchwork Tue Sep 3 14:07:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Antipov X-Patchwork-Id: 13788751 X-Patchwork-Delegate: kuba@kernel.org Received: from forward101b.mail.yandex.net (forward101b.mail.yandex.net [178.154.239.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6A881EB21 for ; Tue, 3 Sep 2024 14:08:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=178.154.239.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372488; cv=none; b=jhuQYID7VUX0kzsOTd5UqQpUaTuCERtoOnP1LsusNW9zhYZ2N093562XO4cQqndubP0zP463hHCvQa+5rBKMHHqei8GIg/jssNN0OyqFLwirIPa69AmawGYAKTc3IltJWSRw7pv+UxJX6JpFIj+zCNmlIc9q1T1hC18F0C+8clk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1725372488; c=relaxed/simple; bh=59F95OUIbpmkMqqAin2tRpgS2e/3I6BPopUerkuQDWk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fO6ZoIWMTZghRr2RpLO5xQWMIM7Dp+r6nNOpQTt0INIhgYk+ZLM9pnihcWF3/0SygwjYVGIx6yGqPXOtynATm3SrfqZbBtCdA8cvElSDQZ1wuszETkgh4uNuogOWPau5J1G78UuqJJM1I/k6QNT3skSutb5TVeLZc4KbX4X0tlg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru; spf=pass smtp.mailfrom=yandex.ru; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b=C+MDPaKT; arc=none smtp.client-ip=178.154.239.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=yandex.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=yandex.ru header.i=@yandex.ru header.b="C+MDPaKT" Received: from mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net [IPv6:2a02:6b8:c08:de2c:0:640:e39b:0]) by forward101b.mail.yandex.net (Yandex) with ESMTPS id 2CDFA60B03; Tue, 3 Sep 2024 17:07:58 +0300 (MSK) Received: by mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net (smtp/Yandex) with ESMTPSA id s7cJDQ0oD0U0-6XpbTIw3; Tue, 03 Sep 2024 17:07:57 +0300 X-Yandex-Fwd: 1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1725372477; bh=pgYcVjbF+SL0tSuILQuEGlht62c1dyFS+zOtG2prJtY=; h=Message-ID:Date:In-Reply-To:Cc:Subject:References:To:From; b=C+MDPaKTBI18ZHovLV8cBEjeHOgmu3eeuPu7hguoQ1hG2LGFMMYNFg13yW1EN/sRg 7JWd/m85RS8cydQ5bIdDAb7oSDzJy/NJGcYc1jGKhV3Mj1TwICDQMSoJDIVhoSxDh1 n3LDgQGU7sF+S1ailw28/hipfNsaXjr/YlNSGf2c= Authentication-Results: mail-nwsmtp-smtp-production-main-31.sas.yp-c.yandex.net; dkim=pass header.i=@yandex.ru From: Dmitry Antipov To: Vinicius Costa Gomes Cc: Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, lvc-project@linuxtesting.org, Dmitry Antipov Subject: [PATCH net v4 3/3] net: sched: use RCU read-side critical section in taprio_dump() Date: Tue, 3 Sep 2024 17:07:08 +0300 Message-ID: <20240903140708.3122263-3-dmantipov@yandex.ru> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240903140708.3122263-1-dmantipov@yandex.ru> References: <20240903140708.3122263-1-dmantipov@yandex.ru> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org Fix possible use-after-free in 'taprio_dump()' by adding RCU read-side critical section there. Never seen on x86 but found on a KASAN-enabled arm64 system when investigating https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa: [T15862] BUG: KASAN: slab-use-after-free in taprio_dump+0xa0c/0xbb0 [T15862] Read of size 4 at addr ffff0000d4bb88f8 by task repro/15862 [T15862] [T15862] CPU: 0 UID: 0 PID: 15862 Comm: repro Not tainted 6.11.0-rc1-00293-gdefaf1a2113a-dirty #2 [T15862] Hardware name: QEMU QEMU Virtual Machine, BIOS edk2-20240524-5.fc40 05/24/2024 [T15862] Call trace: [T15862] dump_backtrace+0x20c/0x220 [T15862] show_stack+0x2c/0x40 [T15862] dump_stack_lvl+0xf8/0x174 [T15862] print_report+0x170/0x4d8 [T15862] kasan_report+0xb8/0x1d4 [T15862] __asan_report_load4_noabort+0x20/0x2c [T15862] taprio_dump+0xa0c/0xbb0 [T15862] tc_fill_qdisc+0x540/0x1020 [T15862] qdisc_notify.isra.0+0x330/0x3a0 [T15862] tc_modify_qdisc+0x7b8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Allocated by task 15857: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_alloc_info+0x40/0x60 [T15862] __kasan_kmalloc+0xd4/0xe0 [T15862] __kmalloc_cache_noprof+0x194/0x334 [T15862] taprio_change+0x45c/0x2fe0 [T15862] tc_modify_qdisc+0x6a8/0x1838 [T15862] rtnetlink_rcv_msg+0x3c8/0xc20 [T15862] netlink_rcv_skb+0x1f8/0x3d4 [T15862] rtnetlink_rcv+0x28/0x40 [T15862] netlink_unicast+0x51c/0x790 [T15862] netlink_sendmsg+0x79c/0xc20 [T15862] __sock_sendmsg+0xe0/0x1a0 [T15862] ____sys_sendmsg+0x6c0/0x840 [T15862] ___sys_sendmsg+0x1ac/0x1f0 [T15862] __sys_sendmsg+0x110/0x1d0 [T15862] __arm64_sys_sendmsg+0x74/0xb0 [T15862] invoke_syscall+0x88/0x2e0 [T15862] el0_svc_common.constprop.0+0xe4/0x2a0 [T15862] do_el0_svc+0x44/0x60 [T15862] el0_svc+0x50/0x184 [T15862] el0t_64_sync_handler+0x120/0x12c [T15862] el0t_64_sync+0x190/0x194 [T15862] [T15862] Freed by task 6192: [T15862] kasan_save_stack+0x3c/0x70 [T15862] kasan_save_track+0x20/0x3c [T15862] kasan_save_free_info+0x4c/0x80 [T15862] poison_slab_object+0x110/0x160 [T15862] __kasan_slab_free+0x3c/0x74 [T15862] kfree+0x134/0x3c0 [T15862] taprio_free_sched_cb+0x18c/0x220 [T15862] rcu_core+0x920/0x1b7c [T15862] rcu_core_si+0x10/0x1c [T15862] handle_softirqs+0x2e8/0xd64 [T15862] __do_softirq+0x14/0x20 Signed-off-by: Dmitry Antipov --- v4: redesign to preserve original code as much as possible, adjust commit message and subject to target net tree v3: tweak commit message as suggested by Vinicius v2: added to the series --- net/sched/sch_taprio.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 9f4e004cdb8b..8623dc0bafc0 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -2374,9 +2374,6 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb) struct tc_mqprio_qopt opt = { 0 }; struct nlattr *nest, *sched_nest; - oper = rtnl_dereference(q->oper_sched); - admin = rtnl_dereference(q->admin_sched); - mqprio_qopt_reconstruct(dev, &opt); nest = nla_nest_start_noflag(skb, TCA_OPTIONS); @@ -2397,18 +2394,23 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb) nla_put_u32(skb, TCA_TAPRIO_ATTR_TXTIME_DELAY, q->txtime_delay)) goto options_error; + rcu_read_lock(); + + oper = rtnl_dereference(q->oper_sched); + admin = rtnl_dereference(q->admin_sched); + if (oper && taprio_dump_tc_entries(skb, q, oper)) - goto options_error; + goto options_error_rcu; if (oper && dump_schedule(skb, oper)) - goto options_error; + goto options_error_rcu; if (!admin) goto done; sched_nest = nla_nest_start_noflag(skb, TCA_TAPRIO_ATTR_ADMIN_SCHED); if (!sched_nest) - goto options_error; + goto options_error_rcu; if (dump_schedule(skb, admin)) goto admin_error; @@ -2416,11 +2418,15 @@ static int taprio_dump(struct Qdisc *sch, struct sk_buff *skb) nla_nest_end(skb, sched_nest); done: + rcu_read_unlock(); return nla_nest_end(skb, nest); admin_error: nla_nest_cancel(skb, sched_nest); +options_error_rcu: + rcu_read_unlock(); + options_error: nla_nest_cancel(skb, nest);