Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e188245d authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-sched-couple-of-chain-fixes' 



Jiri Pirko says:

====================
net: sched: couple of chain fixes

Jiri Pirko (2):
  net: sched: fix use after free when tcf_chain_destroy is called
    multiple times
  net: sched: don't do tcf_chain_flush from tcf_chain_destroy
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents fd6055a8 30d65e8f

net/sched/cls_api.c

+12 −4
Original line number Diff line number Diff line
@@ -215,8 +215,14 @@ static void tcf_chain_flush(struct tcf_chain *chain) 


static void tcf_chain_destroy(struct tcf_chain *chain)

{

	list_del(&chain->list);

	tcf_chain_flush(chain);

	/* May be already removed from the list by the previous call. */

	if (!list_empty(&chain->list))

		list_del_init(&chain->list);



	/* There might still be a reference held when we got here from

	 * tcf_block_put. Wait for the user to drop reference before free.

	 */

	if (!chain->refcnt)

		kfree(chain);

}
@@ -288,8 +294,10 @@ void tcf_block_put(struct tcf_block *block) 
	if (!block)

		return;



	list_for_each_entry_safe(chain, tmp, &block->chain_list, list)

	list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {

		tcf_chain_flush(chain);

		tcf_chain_destroy(chain);

	}

	kfree(block);

}

EXPORT_SYMBOL(tcf_block_put);