Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b00b4bf9 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NET_SCHED]: Fix filter double free 



cbq and atm destroy their filters twice when destroying inner classes
during qdisc destruction.

Reported-and-tested-by: default avatarStrobl Anton <a.strobl@aws-it.at>

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7c355f53

net/sched/sch_atm.c

+1 −0
Original line number Diff line number Diff line
@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch) 
	/* races ? */

	while ((flow = p->flows)) {

		tcf_destroy_chain(flow->filter_list);

		flow->filter_list = NULL;

		if (flow->ref > 1)

			printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow,

			    flow->ref);

net/sched/sch_cbq.c

+5 −3
Original line number Diff line number Diff line
@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch) 
	 * classes from root to leafs which means that filters can still

	 * be bound to classes which have been destroyed already. --TGR '04

	 */

	for (h = 0; h < 16; h++)

		for (cl = q->classes[h]; cl; cl = cl->next)

	for (h = 0; h < 16; h++) {

		for (cl = q->classes[h]; cl; cl = cl->next) {

			tcf_destroy_chain(cl->filter_list);



			cl->filter_list = NULL;

		}

	}

	for (h = 0; h < 16; h++) {

		struct cbq_class *next;