Unverified Commit f7baec69 authored Jul 29, 2023 by openeuler-ci-bot Committed by Gitee Jul 29, 2023

!1556 net/sched: cls_fw: Fix improper refcount update leads to use-after-free

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/CJCCOKFF4BG2FD7U62KB6TCKIJBCPBKK/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7N3N3 
 
Link:https://gitee.com/openeuler/kernel/pulls/1556

 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Signed-off-by: Liu YongQiang <liuyongqiang13@huawei.com>

parents b68be3a4 89019a26

net/sched/cls_fw.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -221,11 +221,6 @@ static int fw_set_parms(struct net net, struct tcf_proto tp,
		if (err < 0)
		return err;

		if (tb[TCA_FW_CLASSID]) {
		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
		tcf_bind_filter(tp, &f->res, base);
		}

		#ifdef CONFIG_NET_CLS_IND
		if (tb[TCA_FW_INDEV]) {
		int ret;
		@@ -244,6 +239,11 @@ static int fw_set_parms(struct net net, struct tcf_proto tp,
		} else if (head->mask != 0xFFFFFFFF)
		return err;

		if (tb[TCA_FW_CLASSID]) {
		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
		tcf_bind_filter(tp, &f->res, base);
		}

		return 0;
		}