On Fri, Sep 25, 2020 at 8:24 AM Vlad Buslov <v...@buslov.dev> wrote:
> > + if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN) &&
> > + !rcu_access_pointer(a->goto_chain)) {
> > + tcf_action_destroy_1(a, bind);
> > + NL_SET_ERR_MSG(extack, "can't use goto chain with NULL
> > chain");
> > + return ERR_PTR(-EINVAL);
> > + }
>
> I don't think calling tcf_action_destoy_1() is enough here. Since you
> moved this block before assigning cookie and releasing the module, you
> also need to release them manually in addition to destroying the action
> instance.
>
tcf_action_destoy_1() eventually calls free_tcf() which frees cookie and
tcf_action_destroy() which releases module refcnt.
What am I missing here?
Thanks.
