From: Cong Wang <xiyou.wangc...@gmail.com>
Date: Wed, 8 Jul 2020 20:13:59 -0700
> When tcf_block_get() fails inside atm_tc_init(),
> atm_tc_put() is called to release the qdisc p->link.q.
> But the flow->ref prevents it to do so, as the flow->ref
> is still zero.
>
> Fix this by moving the p->link.ref initialization before
> tcf_block_get().
>
> Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
> Reported-and-tested-by: syzbot+d411cff6ab29cc2c3...@syzkaller.appspotmail.com
> Cc: Jamal Hadi Salim <j...@mojatatu.com>
> Cc: Jiri Pirko <j...@resnulli.us>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
Applied and queued up for -stable, thanks.
