Re: [PATCH net] cls_flower: fix use after free in flower S/W path

2018-06-21 Thread Paolo Abeni
Hi, On Wed, 2018-06-20 at 11:06 -0700, Cong Wang wrote: > On Wed, Jun 20, 2018 at 10:34 AM, Paolo Abeni wrote: > > > > +static void fl_mask_free(struct fl_flow_mask *mask) > > +{ > > + rhashtable_destroy(&mask->ht); > > I don't believe you can call rhashtable_destroy() in BH > context, it

Re: [PATCH net] cls_flower: fix use after free in flower S/W path

2018-06-20 Thread Cong Wang
On Wed, Jun 20, 2018 at 10:34 AM, Paolo Abeni wrote: > > +static void fl_mask_free(struct fl_flow_mask *mask) > +{ > + rhashtable_destroy(&mask->ht); I don't believe you can call rhashtable_destroy() in BH context, it acquires a mutex...

[PATCH net] cls_flower: fix use after free in flower S/W path

2018-06-20 Thread Paolo Abeni
If flower filter is created without the skip_sw flag, fl_mask_put() can race with fl_classify() and we can destroy the mask rhashtable while a lookup operation is accessing it. BUG: unable to handle kernel paging request at 000911d1 PGD 0 P4D 0 SMP PTI CPU: 3 PID: 5582 Comm: vhost-5541