Commit e188245d authored by David S. Miller's avatar David S. Miller

Merge branch 'net-sched-couple-of-chain-fixes'

Jiri Pirko says:

====================
net: sched: couple of chain fixes

Jiri Pirko (2):
  net: sched: fix use after free when tcf_chain_destroy is called
    multiple times
  net: sched: don't do tcf_chain_flush from tcf_chain_destroy
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents fd6055a8 30d65e8f
...@@ -215,8 +215,14 @@ static void tcf_chain_flush(struct tcf_chain *chain) ...@@ -215,8 +215,14 @@ static void tcf_chain_flush(struct tcf_chain *chain)
static void tcf_chain_destroy(struct tcf_chain *chain) static void tcf_chain_destroy(struct tcf_chain *chain)
{ {
list_del(&chain->list); /* May be already removed from the list by the previous call. */
tcf_chain_flush(chain); if (!list_empty(&chain->list))
list_del_init(&chain->list);
/* There might still be a reference held when we got here from
* tcf_block_put. Wait for the user to drop reference before free.
*/
if (!chain->refcnt)
kfree(chain); kfree(chain);
} }
...@@ -288,8 +294,10 @@ void tcf_block_put(struct tcf_block *block) ...@@ -288,8 +294,10 @@ void tcf_block_put(struct tcf_block *block)
if (!block) if (!block)
return; return;
list_for_each_entry_safe(chain, tmp, &block->chain_list, list) list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {
tcf_chain_flush(chain);
tcf_chain_destroy(chain); tcf_chain_destroy(chain);
}
kfree(block); kfree(block);
} }
EXPORT_SYMBOL(tcf_block_put); EXPORT_SYMBOL(tcf_block_put);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment