From: Vlad Buslov <[email protected]>
Date: Mon, 25 Feb 2019 17:30:14 +0200
> Tunnel key action params->tcft_enc_metadata is only set when action is
> TCA_TUNNEL_KEY_ACT_SET. However, metadata pointer is incorrectly
> dereferenced during tunnel key init and release without verifying that
> action is if correct type, which causes NULL pointer dereference. Metadata
> tunnel dst_cache is also leaked on action overwrite.
>
> Fix metadata handling:
> - Verify that metadata pointer is not NULL before dereferencing it in
> tunnel_key_init error handling code.
> - Move dst_cache destroy code into tunnel_key_release_params() function
> that is called in both action overwrite and release cases (fixes resource
> leak) and verifies that actions has correct type before dereferencing
> metadata pointer (fixes NULL pointer dereference).
>
> Oops with KASAN enabled during tdc tests execution:
...
> Fixes: 41411e2fd6b8 ("net/sched: act_tunnel_key: Add dst_cache support")
> Signed-off-by: Vlad Buslov <[email protected]>
> ---
> Changes from V1 to V2:
> - Extract metadata->dst error handler fix into standalone patch that targets
> net.
Applied, thanks Vlad.
