From: Eric Dumazet <eric.duma...@gmail.com> Date: Fri, 10 Feb 2017 10:31:49 -0800
> From: Eric Dumazet <eduma...@google.com> > > Dmitry reported uses after free in qdisc code [1] > > The problem here is that ops->init() can return an error. > > qdisc_create_dflt() then call ops->destroy(), > while qdisc_create() does _not_ call it. > > Four qdisc chose to call their own ops->destroy(), assuming their caller > would not. > > This patch makes sure qdisc_create() calls ops->destroy() > and fixes the four qdisc to avoid double free. ... > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: Dmitry Vyukov <dvyu...@google.com> Applied, thanks Eric.
