Commit e188245d authored by David S. Miller's avatar David S. Miller

Merge branch 'net-sched-couple-of-chain-fixes'

Jiri Pirko says:

====================
net: sched: couple of chain fixes

Jiri Pirko (2):
  net: sched: fix use after free when tcf_chain_destroy is called
    multiple times
  net: sched: don't do tcf_chain_flush from tcf_chain_destroy
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents fd6055a8 30d65e8f
......@@ -215,8 +215,14 @@ static void tcf_chain_flush(struct tcf_chain *chain)
static void tcf_chain_destroy(struct tcf_chain *chain)
{
list_del(&chain->list);
tcf_chain_flush(chain);
/* May be already removed from the list by the previous call. */
if (!list_empty(&chain->list))
list_del_init(&chain->list);
/* There might still be a reference held when we got here from
* tcf_block_put. Wait for the user to drop reference before free.
*/
if (!chain->refcnt)
kfree(chain);
}
......@@ -288,8 +294,10 @@ void tcf_block_put(struct tcf_block *block)
if (!block)
return;
list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {
tcf_chain_flush(chain);
tcf_chain_destroy(chain);
}
kfree(block);
}
EXPORT_SYMBOL(tcf_block_put);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment