diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-09-03 11:08:15 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-09-15 09:42:54 +0200 |
| commit | 4fb15ff15b2c196b0e0a1df160181545c7b1d527 (patch) | |
| tree | 3018ce4bb06cdac34fe9d967c8e4c56d9d71ddae /net | |
| parent | bc71f393d31c68d3173381aab8f8b3bfdc43bbb9 (diff) | |
act_ife: fix a potential use-after-free
[ Upstream commit 6d784f1625ea68783cc1fb17de8f6cd3e1660c3f ]
Immediately after module_put(), user could delete this
module, so e->ops could be already freed before we call
e->ops->release().
Fix this by moving module_put() after ops->release().
Fixes: ef6980b6becb ("introduce IFE action")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/act_ife.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 235db2c9bbbb..df90ca9cd95b 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -395,7 +395,6 @@ static void _tcf_ife_cleanup(struct tc_action *a, int bind) struct tcf_meta_info *e, *n; list_for_each_entry_safe(e, n, &ife->metalist, metalist) { - module_put(e->ops->owner); list_del(&e->metalist); if (e->metaval) { if (e->ops->release) @@ -403,6 +402,7 @@ static void _tcf_ife_cleanup(struct tc_action *a, int bind) else kfree(e->metaval); } + module_put(e->ops->owner); kfree(e); } } |