net_sched: fix an OOB access in cls_tcindex

As Eric noticed, tcindex_alloc_perfect_hash() uses cp->hash
to compute the size of memory allocation, but cp->hash is
set again after the allocation, this caused an out-of-bound

So we have to move all cp->hash initialization and computation
before the memory allocation. Move cp->mask and cp->shift together
as cp->hash may need them for computation too.

Fixes: 331b72922c5f ("net: sched: RCU cls_tcindex")
Cc: Eric Dumazet <>
Cc: John Fastabend <>
Cc: Jamal Hadi Salim <>
Cc: Jiri Pirko <>
Cc: Jakub Kicinski <>
Signed-off-by: Cong Wang <>
Signed-off-by: David S. Miller <>
1 file changed