net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic...

[pandora-kernel.git] / net / sched / cls_api.c

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 0759f32..09cdcdf 100644 (file)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
        unsigned long cl;
        unsigned long fh;
        int err;
+       int tp_created = 0;
 
        if (net != &init_net)
                return -EINVAL;
@@ -266,10 +267,7 @@ replay:
                        goto errout;
                }
 
-               spin_lock_bh(root_lock);
-               tp->next = *back;
-               *back = tp;
-               spin_unlock_bh(root_lock);
+               tp_created = 1;
 
        } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
                goto errout;
@@ -296,8 +294,11 @@ replay:
                switch (n->nlmsg_type) {
                case RTM_NEWTFILTER:
                        err = -EEXIST;
-                       if (n->nlmsg_flags & NLM_F_EXCL)
+                       if (n->nlmsg_flags & NLM_F_EXCL) {
+                               if (tp_created)
+                                       tcf_destroy(tp);
                                goto errout;
+                       }
                        break;
                case RTM_DELTFILTER:
                        err = tp->ops->delete(tp, fh);
@@ -314,8 +315,18 @@ replay:
        }
 
        err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-       if (err == 0)
+       if (err == 0) {
+               if (tp_created) {
+                       spin_lock_bh(root_lock);
+                       tp->next = *back;
+                       *back = tp;
+                       spin_unlock_bh(root_lock);
+               }
                tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+       } else {
+               if (tp_created)
+                       tcf_destroy(tp);
+       }
 
 errout:
        if (cl)