On Wed, Mar 20, 2019 at 11:12 AM John Hurley <john.hur...@netronome.com> wrote:
>
> A new mirred action is created by the tcf_mirred_init function. This
> contains a list head struct which is inserted into a global list on
> successful creation of a new action. However, after a creation, it is
> still possible to error out if the egress device does not exist. This
> calls the act_mirr cleanup function via __tcf_idr_release and
> __tcf_action_put. This cleanup function tries to delete the list entry
> which is as yet uninitialised, leading to a NULL pointer exception.
Hmm, good catch but can this be just fixed by initializing it before
taking the netdevice refcnt? Like this:
@@ -163,6 +163,9 @@ static int tcf_mirred_init(struct net *net, struct
nlattr *nla,
m->tcf_action = parm->action;
m->tcfm_eaction = parm->eaction;
+ if (ret == ACT_P_CREATED)
+ INIT_LIST_HEAD(&m->tcfm_list);
+
if (parm->ifindex) {
dev = dev_get_by_index(net, parm->ifindex);
if (!dev) {
which is also much simpler.
Thanks.
