Unverified Commit 7b1a5167 authored Aug 03, 2023 by openeuler-ci-bot Committed by Gitee Aug 03, 2023

!1587 [sync] PR-1557: net/sched: cls_fw: Fix improper refcount update leads to use-after-free

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/1557 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/233WCLKDGOFGUPF6WDFRIM426TVBRFML/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7N3N3 
 
Link:https://gitee.com/openeuler/kernel/pulls/1587

 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>

parents 4a7c6659 5f5b0e1b

net/sched/cls_fw.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -210,11 +210,6 @@ static int fw_set_parms(struct net net, struct tcf_proto tp,
		if (err < 0)
		return err;

		if (tb[TCA_FW_CLASSID]) {
		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
		tcf_bind_filter(tp, &f->res, base);
		}

		if (tb[TCA_FW_INDEV]) {
		int ret;
		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
		@@ -231,6 +226,11 @@ static int fw_set_parms(struct net net, struct tcf_proto tp,
		} else if (head->mask != 0xFFFFFFFF)
		return err;

		if (tb[TCA_FW_CLASSID]) {
		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
		tcf_bind_filter(tp, &f->res, base);
		}

		return 0;
		}