提交 b00b4bf9 编写于 作者: P Patrick McHardy 提交者: David S. Miller

[NET_SCHED]: Fix filter double free

cbq and atm destroy their filters twice when destroying inner classes
during qdisc destruction.
Reported-and-tested-by: NStrobl Anton <a.strobl@aws-it.at>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 7c355f53
...@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch) ...@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch)
/* races ? */ /* races ? */
while ((flow = p->flows)) { while ((flow = p->flows)) {
tcf_destroy_chain(flow->filter_list); tcf_destroy_chain(flow->filter_list);
flow->filter_list = NULL;
if (flow->ref > 1) if (flow->ref > 1)
printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow, printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow,
flow->ref); flow->ref);
......
...@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch) ...@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch)
* classes from root to leafs which means that filters can still * classes from root to leafs which means that filters can still
* be bound to classes which have been destroyed already. --TGR '04 * be bound to classes which have been destroyed already. --TGR '04
*/ */
for (h = 0; h < 16; h++) for (h = 0; h < 16; h++) {
for (cl = q->classes[h]; cl; cl = cl->next) for (cl = q->classes[h]; cl; cl = cl->next) {
tcf_destroy_chain(cl->filter_list); tcf_destroy_chain(cl->filter_list);
cl->filter_list = NULL;
}
}
for (h = 0; h < 16; h++) { for (h = 0; h < 16; h++) {
struct cbq_class *next; struct cbq_class *next;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册