diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-09-03 11:08:15 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-09-04 12:18:25 -0700 |
| commit | 6d784f1625ea68783cc1fb17de8f6cd3e1660c3f (patch) | |
| tree | b5522e1f480bd5166de5844f71e51c2eaecdca48 | |
| parent | 639505d4397b8c654a8e2616f9cb70ece40c83f9 (diff) | |
| download | linux-6d784f1625ea68783cc1fb17de8f6cd3e1660c3f.tar.bz2 | |
act_ife: fix a potential use-after-free
Immediately after module_put(), user could delete this
module, so e->ops could be already freed before we call
e->ops->release().
Fix this by moving module_put() after ops->release().
Fixes: ef6980b6becb ("introduce IFE action")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/act_ife.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 196430aefe87..fc412769a1be 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -400,7 +400,6 @@ static void _tcf_ife_cleanup(struct tc_action *a) struct tcf_meta_info *e, *n; list_for_each_entry_safe(e, n, &ife->metalist, metalist) { - module_put(e->ops->owner); list_del(&e->metalist); if (e->metaval) { if (e->ops->release) @@ -408,6 +407,7 @@ static void _tcf_ife_cleanup(struct tc_action *a) else kfree(e->metaval); } + module_put(e->ops->owner); kfree(e); } } |