From nobody Sat Feb 7 22:07:16 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5D08C04A94 for ; Wed, 2 Aug 2023 21:24:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231277AbjHBVYK (ORCPT ); Wed, 2 Aug 2023 17:24:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33288 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229446AbjHBVYI (ORCPT ); Wed, 2 Aug 2023 17:24:08 -0400 Received: from smtp-fw-2101.amazon.com (smtp-fw-2101.amazon.com [72.21.196.25]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11E8CAC; Wed, 2 Aug 2023 14:24:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1691011447; x=1722547447; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=UGL2vJ6MLNe12v+8D3skuK9/dM3RwPLrOS4RD+wo23g=; b=Ku1U123VDtKWrc6vTmdiowKBuBCaZ6iXvCNNQwZ/Mrai77BDapiNpnAU HbH59f27LawLohhjOoa1Sy9BiF+RW4W/io0sxVSjL99OcG1rpMyNNZB4Y 6hyyad8Q56DFXB+SvaJBYTNhoD9app/sEMVNWxFmC/1TmPUShaILEU41T 0=; X-IronPort-AV: E=Sophos;i="6.01,250,1684800000"; d="scan'208";a="343285625" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-iad-1e-m6i4x-245b69b1.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-2101.iad2.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Aug 2023 21:24:06 +0000 Received: from EX19MTAUWC001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1e-m6i4x-245b69b1.us-east-1.amazon.com (Postfix) with ESMTPS id 0E8A4344A1E; Wed, 2 Aug 2023 21:24:04 +0000 (UTC) Received: from EX19D002UWC002.ant.amazon.com (10.13.138.166) by EX19MTAUWC001.ant.amazon.com (10.250.64.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.30; Wed, 2 Aug 2023 21:24:04 +0000 Received: from EX19MTAUEA001.ant.amazon.com (10.252.134.203) by EX19D002UWC002.ant.amazon.com (10.13.138.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.30; Wed, 2 Aug 2023 21:24:04 +0000 Received: from dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (10.189.73.169) by mail-relay.amazon.com (10.252.134.102) with Microsoft SMTP Server id 15.2.1118.30 via Frontend Transport; Wed, 2 Aug 2023 21:24:03 +0000 Received: by dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (Postfix, from userid 22673075) id 85C4FE4C; Wed, 2 Aug 2023 21:24:03 +0000 (UTC) From: Rishabh Bhatnagar To: , CC: , , , , Eric Dumazet , Jamal Hadi Salim , Rishabh Bhatnagar Subject: [PATCH 4.19] net/sched: cls_u32: Fix reference counter leak leading to overflow Date: Wed, 2 Aug 2023 21:23:55 +0000 Message-ID: <20230802212355.27982-1-risbhat@amazon.com> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lee Jones Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc. In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change = for newly allocated struct") Suggested-by: Eric Dumazet Signed-off-by: Lee Jones Reviewed-by: Eric Dumazet Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Rishabh Bhatnagar --- net/sched/cls_u32.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index d30256ac3537..ee8ef606a8e9 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_= proto *tp, struct netlink_ext_ack *extack) { int err; +#ifdef CONFIG_NET_CLS_IND + int ifindex =3D -1; +#endif =20 err =3D tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; =20 +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex =3D tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle =3D nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down =3D NULL, *ht_old; @@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_p= roto *tp, } =20 #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret =3D tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex =3D ret; - } + if (ifindex >=3D 0) + n->ifindex =3D ifindex; #endif return 0; } --=20 2.40.1