net_sched: fix a race condition in tcindex_destroy()
authorCong Wang <xiyou.wangcong@gmail.com>
Sat, 16 Feb 2019 18:58:26 +0000 (10:58 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 21 Feb 2019 04:11:10 +0000 (20:11 -0800)
commit3d210534cc93dab39a9d1a8d674aa2872c268d38
treeb2c64f1f04e65965284581675b8ee1d122763ae2
parent418e897e0716b238ea4252ed22a73ca37d3cbbc1
net_sched: fix a race condition in tcindex_destroy()

(cherry picked from commit 8015d93ebd27484418d4952284fd02172fa4b0b2)

tcindex_destroy() invokes tcindex_destroy_element() via
a walker to delete each filter result in its perfect hash
table, and tcindex_destroy_element() calls tcindex_delete()
which schedules tcf RCU works to do the final deletion work.
Unfortunately this races with the RCU callback
__tcindex_destroy(), which could lead to use-after-free as
reported by Adrian.

Fix this by migrating this RCU callback to tcf RCU work too,
as that workqueue is ordered, we will not have use-after-free.

Note, we don't need to hold netns refcnt because we don't call
tcf_exts_destroy() here.

Fixes: 27ce4f05e2ab ("net_sched: use tcf_queue_work() in tcindex filter")
Reported-by: Adrian <bugs@abtelecom.ro>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/cls_tcindex.c