net: sched: act_sample: fix psample group handling on overwrite
authorVlad Buslov <vladbu@mellanox.com>
Tue, 27 Aug 2019 18:49:38 +0000 (21:49 +0300)
committerDavid S. Miller <davem@davemloft.net>
Wed, 28 Aug 2019 22:53:51 +0000 (15:53 -0700)
commitdbf47a2a094edf58983265e323ca4bdcdb58b5ee
tree4d67881165f57063cadc0456b7c7e5c8be0b5090
parent36f1031c51a2538e5558fb44c6d6b88f98d3c0f2
net: sched: act_sample: fix psample group handling on overwrite

Action sample doesn't properly handle psample_group pointer in overwrite
case. Following issues need to be fixed:

- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
  s->psample_group, even though we neither setting the pointer to NULL, nor
  preventing concurrent readers from accessing the pointer in some way.
  Use rcu_swap_protected() instead to safely reset the pointer.

- Old value of s->psample_group is not released or deallocated in any way,
  which results resource leak. Use psample_group_put() on non-NULL value
  obtained with rcu_swap_protected().

- The function psample_group_put() that released reference to struct
  psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
  grace period when deallocating it. Extend struct psample_group with rcu
  head and use kfree_rcu when freeing it.

Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/psample.h
net/psample/psample.c
net/sched/act_sample.c