aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-06-05 19:06:59 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2007-06-07 16:41:05 -0400
commitb00b4bf94edb42852d55619af453588b2de2dc5e (patch)
tree01f79f50daf04a1f73a5d93365307711907b3169 /net
parent7c355f532dd43036622e1880c114773463bafd23 (diff)
[NET_SCHED]: Fix filter double free
cbq and atm destroy their filters twice when destroying inner classes during qdisc destruction. Reported-and-tested-by: Strobl Anton <a.strobl@aws-it.at> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/sched/sch_atm.c1
-rw-r--r--net/sched/sch_cbq.c8
2 files changed, 6 insertions, 3 deletions
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index be7d299acd73..d1c383fca82c 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch)
599 /* races ? */ 599 /* races ? */
600 while ((flow = p->flows)) { 600 while ((flow = p->flows)) {
601 tcf_destroy_chain(flow->filter_list); 601 tcf_destroy_chain(flow->filter_list);
602 flow->filter_list = NULL;
602 if (flow->ref > 1) 603 if (flow->ref > 1)
603 printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow, 604 printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow,
604 flow->ref); 605 flow->ref);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index a294542cb8e4..ee2d5967d109 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch)
1748 * classes from root to leafs which means that filters can still 1748 * classes from root to leafs which means that filters can still
1749 * be bound to classes which have been destroyed already. --TGR '04 1749 * be bound to classes which have been destroyed already. --TGR '04
1750 */ 1750 */
1751 for (h = 0; h < 16; h++) 1751 for (h = 0; h < 16; h++) {
1752 for (cl = q->classes[h]; cl; cl = cl->next) 1752 for (cl = q->classes[h]; cl; cl = cl->next) {
1753 tcf_destroy_chain(cl->filter_list); 1753 tcf_destroy_chain(cl->filter_list);
1754 1754 cl->filter_list = NULL;
1755 }
1756 }
1755 for (h = 0; h < 16; h++) { 1757 for (h = 0; h < 16; h++) {
1756 struct cbq_class *next; 1758 struct cbq_class *next;
1757 1759