git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1006da1) | patch
net_sched: fix a use-after-free in tc_ctl_tfilter()
authorWANG Cong <xiyou.wangcong@gmail.com>
Tue, 5 May 2015 22:22:02 +0000 (15:22 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sat, 9 May 2015 20:14:04 +0000 (16:14 -0400)
commitd744318574090c3b796915d9d710bdb17db191a1
tree86814b3ab96984332dc666650a574e835008516ctree | snapshot
parent1006da19ea6603135773a79f09e4e931be460429commit | diff
net_sched: fix a use-after-free in tc_ctl_tfilter()

When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.

For long term, we probably should move tp list to list_head.

Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sched/cls_api.c diff | blob | history
Pandora Kernel Repository