net_sched: act: refuse to remove bound action outside

When an action is bonnd to a filter, there is no point to
remove it outside. Currently we just silently decrease the refcnt,
we should reject this explicitly with EPERM.

Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/act_api.h b/include/net/act_api.h
index 969cac6344aa42be0b65e414fda178e06245bf9d..3ee4c92afd1bd2baf2b90201a9b4af896d020b5f 100644 (file)
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -109,7 +109,7 @@ void tcf_hash_insert(struct tc_action *a);
 
 int tcf_register_action(struct tc_action_ops *a, unsigned int mask);
 int tcf_unregister_action(struct tc_action_ops *a);
 
 int tcf_register_action(struct tc_action_ops *a, unsigned int mask);
 int tcf_unregister_action(struct tc_action_ops *a);

-void tcf_action_destroy(struct list_head *actions, int bind);
+int tcf_action_destroy(struct list_head *actions, int bind);

 int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
                    struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,
 int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
                    struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index c88d382d3b098ffe13aefef5d753b601dcd17aee..27e4c531ade1fc629d1d338fb5402e9f863654ef 100644 (file)
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -53,6 +53,8 @@ int tcf_hash_release(struct tc_action *a, int bind)
        if (p) {
                if (bind)
                        p->tcfc_bindcnt--;
        if (p) {
                if (bind)
                        p->tcfc_bindcnt--;

+               else if (p->tcfc_bindcnt > 0)
+                       return -EPERM;

 
                p->tcfc_refcnt--;
                if (p->tcfc_bindcnt <= 0 && p->tcfc_refcnt <= 0) {
 
                p->tcfc_refcnt--;
                if (p->tcfc_bindcnt <= 0 && p->tcfc_refcnt <= 0) {


@@ -123,6 +125,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
        struct tcf_common *p;
        struct nlattr *nest;
        int i = 0, n_i = 0;
        struct tcf_common *p;
        struct nlattr *nest;
        int i = 0, n_i = 0;

+       int ret = -EINVAL;

 
        nest = nla_nest_start(skb, a->order);
        if (nest == NULL)
 
        nest = nla_nest_start(skb, a->order);
        if (nest == NULL)


@@ -133,10 +136,12 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
                head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
                hlist_for_each_entry_safe(p, n, head, tcfc_head) {
                        a->priv = p;
                head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
                hlist_for_each_entry_safe(p, n, head, tcfc_head) {
                        a->priv = p;

-                       if (ACT_P_DELETED == tcf_hash_release(a, 0)) {
+                       ret = tcf_hash_release(a, 0);
+                       if (ret == ACT_P_DELETED) {

                                module_put(a->ops->owner);
                                n_i++;
                                module_put(a->ops->owner);
                                n_i++;

-                       }
+                       } else if (ret < 0)
+                               goto nla_put_failure;

                }
        }
        if (nla_put_u32(skb, TCA_FCNT, n_i))
                }
        }
        if (nla_put_u32(skb, TCA_FCNT, n_i))


@@ -146,7 +151,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
        return n_i;
 nla_put_failure:
        nla_nest_cancel(skb, nest);
        return n_i;
 nla_put_failure:
        nla_nest_cancel(skb, nest);

-       return -EINVAL;
+       return ret;

 }
 
 static int tcf_generic_walker(struct sk_buff *skb, struct netlink_callback *cb,
 }
 
 static int tcf_generic_walker(struct sk_buff *skb, struct netlink_callback *cb,


@@ -401,16 +406,21 @@ exec_done:
 }
 EXPORT_SYMBOL(tcf_action_exec);
 
 }
 EXPORT_SYMBOL(tcf_action_exec);
 

-void tcf_action_destroy(struct list_head *actions, int bind)
+int tcf_action_destroy(struct list_head *actions, int bind)

 {
        struct tc_action *a, *tmp;
 {
        struct tc_action *a, *tmp;

+       int ret = 0;

 
        list_for_each_entry_safe(a, tmp, actions, list) {
 
        list_for_each_entry_safe(a, tmp, actions, list) {

-               if (tcf_hash_release(a, bind) == ACT_P_DELETED)
+               ret = tcf_hash_release(a, bind);
+               if (ret == ACT_P_DELETED)

                        module_put(a->ops->owner);
                        module_put(a->ops->owner);

+               else if (ret < 0)
+                       return ret;

                list_del(&a->list);
                kfree(a);
        }
                list_del(&a->list);
                kfree(a);
        }

+       return ret;

 }
 
 int
 }
 
 int


@@ -838,7 +848,11 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
        }
 
        /* now do the delete */
        }
 
        /* now do the delete */

-       tcf_action_destroy(actions, 0);
+       ret = tcf_action_destroy(actions, 0);
+       if (ret < 0) {
+               kfree_skb(skb);
+               return ret;
+       }

 
        ret = rtnetlink_send(skb, net, portid, RTNLGRP_TC,
                             n->nlmsg_flags & NLM_F_ECHO);
 
        ret = rtnetlink_send(skb, net, portid, RTNLGRP_TC,
                             n->nlmsg_flags & NLM_F_ECHO);