forked from luck/tmp_suning_uos_patched
12186be7d2
This patch fixes a bug which unconfigured struct tcf_proto keeps chaining in tc_ctl_tfilter(), and avoids kernel panic in cls_cgroup_classify() when we use cls_cgroup. When we execute 'tc filter add', tcf_proto is allocated, initialized by classifier's init(), and chained. After it's chained, tc_ctl_tfilter() calls classifier's change(). When classifier's change() fails, tc_ctl_tfilter() does not free and keeps tcf_proto. In addition, cls_cgroup is initialized in change() not in init(). It accesses unconfigured struct tcf_proto which is chained before change(), then hits Oops. Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp> Signed-off-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca> Tested-by: Minoru Usui <usui@mxm.nes.nec.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
act_api.c | ||
act_gact.c | ||
act_ipt.c | ||
act_mirred.c | ||
act_nat.c | ||
act_pedit.c | ||
act_police.c | ||
act_simple.c | ||
act_skbedit.c | ||
cls_api.c | ||
cls_basic.c | ||
cls_cgroup.c | ||
cls_flow.c | ||
cls_fw.c | ||
cls_route.c | ||
cls_rsvp6.c | ||
cls_rsvp.c | ||
cls_rsvp.h | ||
cls_tcindex.c | ||
cls_u32.c | ||
em_cmp.c | ||
em_meta.c | ||
em_nbyte.c | ||
em_text.c | ||
em_u32.c | ||
ematch.c | ||
Kconfig | ||
Makefile | ||
sch_api.c | ||
sch_atm.c | ||
sch_blackhole.c | ||
sch_cbq.c | ||
sch_drr.c | ||
sch_dsmark.c | ||
sch_fifo.c | ||
sch_generic.c | ||
sch_gred.c | ||
sch_hfsc.c | ||
sch_htb.c | ||
sch_ingress.c | ||
sch_multiq.c | ||
sch_netem.c | ||
sch_prio.c | ||
sch_red.c | ||
sch_sfq.c | ||
sch_tbf.c | ||
sch_teql.c |