From: Eric Dumazet <[email protected]> Date: Fri, 10 Feb 2017 10:31:49 -0800
> From: Eric Dumazet <[email protected]> > > Dmitry reported uses after free in qdisc code [1] > > The problem here is that ops->init() can return an error. > > qdisc_create_dflt() then call ops->destroy(), > while qdisc_create() does _not_ call it. > > Four qdisc chose to call their own ops->destroy(), assuming their caller > would not. > > This patch makes sure qdisc_create() calls ops->destroy() > and fixes the four qdisc to avoid double free. ... > Signed-off-by: Eric Dumazet <[email protected]> > Reported-by: Dmitry Vyukov <[email protected]> Applied, thanks Eric.
