net: sched: fix use after free when tcf_chain_destroy is called multiple times

[karo-tx-linux.git] / net / sched / cls_api.c

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 9fd44c22134783edf3db4f62ff1e8184c455cbd7..45cd34eee72701240901a250cbf2a6f071737afc 100644 (file)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -215,9 +215,17 @@ static void tcf_chain_flush(struct tcf_chain *chain)
 
 static void tcf_chain_destroy(struct tcf_chain *chain)
 {
-       list_del(&chain->list);
+       /* May be already removed from the list by the previous call. */
+       if (!list_empty(&chain->list))
+               list_del_init(&chain->list);
+
        tcf_chain_flush(chain);
-       kfree(chain);
+
+       /* There might still be a reference held when we got here from
+        * tcf_block_put. Wait for the user to drop reference before free.
+        */
+       if (!chain->refcnt)
+               kfree(chain);
 }
 
 struct tcf_chain *tcf_chain_get(struct tcf_block *block, u32 chain_index,