blob: 422314bc84e3837b5151a7235a8713ead7f5dd0a [file] [log] [blame]
From 9764b843343cb483e255a8730e37456dba734ad0 Mon Sep 17 00:00:00 2001
From: Cong Wang <>
Date: Wed, 11 Mar 2020 22:42:27 -0700
Subject: [PATCH] net_sched: hold rtnl lock in tcindex_partial_destroy_work()
commit b1be2e8cd290f620777bfdb8aa00890cd2fa02b5 upstream.
syzbot reported a use-after-free in tcindex_dump(). This is due to
the lack of RTNL in the deferred rcu work. We queue this work with
RTNL in tcindex_change(), later, tcindex_dump() is called:
fh = tp->ops->get(tp, t->tcm_handle);
err = tp->ops->change(..., &fh, ...);
tfilter_notify(..., fh, ...);
but there is nothing to serialize the pending
tcindex_partial_destroy_work() with tcindex_dump().
Fix this by simply holding RTNL in tcindex_partial_destroy_work(),
so that it won't be called until RTNL is released after
tc_new_tfilter() is completed.
Fixes: 3d210534cc93 ("net_sched: fix a race condition in tcindex_destroy()")
Cc: Jamal Hadi Salim <>
Cc: Jiri Pirko <>
Signed-off-by: Cong Wang <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index ab95bbe20e3d..9904299424a1 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -261,8 +261,10 @@ static void tcindex_partial_destroy_work(struct work_struct *work)
struct tcindex_data,
+ rtnl_lock();
+ rtnl_unlock();
static void tcindex_free_perfect_hash(struct tcindex_data *cp)