net: sched: do not use tcf_proto 'tp' argument from call_rcu

Using the tcf_proto pointer 'tp' from inside the classifiers callback
is not valid because it may have been cleaned up by another call_rcu
occuring on another CPU.

'tp' is currently being used by tcf_unbind_filter() in this patch we
move instances of tcf_unbind_filter outside of the call_rcu() context.
This is safe to do because any running schedulers will either read the
valid class field or it will be zeroed.

And all schedulers today when the class is 0 do a lookup using the
same call used by the tcf_exts_bind(). So even if we have a running
classifier hit the null class pointer it will do a lookup and get
to the same result. This is particularly fragile at the moment because
the only way to verify this is to audit the schedulers call sites.

Reported-by: Cong Wang <xiyou.wangconf@gmail.com>
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 4318d067b0a0..eed49d1d0878 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -92,7 +92,6 @@ static int cls_bpf_init(struct tcf_proto *tp)
 
 static void cls_bpf_delete_prog(struct tcf_proto *tp, struct cls_bpf_prog *prog)
 {
-        tcf_unbind_filter(tp, &prog->res);
         tcf_exts_destroy(&prog->exts);
 
         bpf_prog_destroy(prog->filter);
@@ -116,6 +115,7 @@ static int cls_bpf_delete(struct tcf_proto *tp, unsigned long arg)
         list_for_each_entry(prog, &head->plist, link) {
                 if (prog == todel) {
                         list_del_rcu(&prog->link);
+                        tcf_unbind_filter(tp, &prog->res);
                         call_rcu(&prog->rcu, __cls_bpf_delete_prog);
                         return 0;
                 }
@@ -131,6 +131,7 @@ static void cls_bpf_destroy(struct tcf_proto *tp)
 
         list_for_each_entry_safe(prog, tmp, &head->plist, link) {
                 list_del_rcu(&prog->link);
+                tcf_unbind_filter(tp, &prog->res);
                 call_rcu(&prog->rcu, __cls_bpf_delete_prog);
         }
 
@@ -282,6 +283,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
 
         if (oldprog) {
                 list_replace_rcu(&prog->link, &oldprog->link);
+                tcf_unbind_filter(tp, &oldprog->res);
                 call_rcu(&oldprog->rcu, __cls_bpf_delete_prog);
         } else {
                 list_add_rcu(&prog->link, &head->plist);