From: WANG Cong <xiyou.wangcong@gmail.com>
Date: Tue, 5 May 2015 22:22:02 +0000 (-0700)
Subject: net_sched: fix a use-after-free in tc_ctl_tfilter()
X-Git-Tag: omap-for-v4.2/wakeirq-drivers~2^2~30^2~21
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d744318574090c3b796915d9d710bdb17db191a1;p=pandora-kernel.git

net_sched: fix a use-after-free in tc_ctl_tfilter()

When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.

For long term, we probably should move tp list to list_head.

Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed