David Miller <[email protected]> writes: > From: Petr Machata <[email protected]> > Date: Mon, 4 Feb 2019 14:50:38 +0000 > >> In fl_change(), when adding a new rule (i.e. fold == NULL), a driver may >> reject the new rule, for example due to resource exhaustion. By that >> point, the new rule was already assigned a mask, and it was added to >> that mask's hash table. The clean-up path that's invoked as a result of >> the rejection however neglects to undo the hash table addition, and >> proceeds to free the new rule, thus leaving a dangling pointer in the >> hash table. >> >> Fix by removing fnew from the mask's hash table before it is freed. >> >> Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules >> also under skip_sw") > > Please do not break up lone Fixes: tag lines in the future, I fixed it > up for you this time.
Sorry about that and thanks.
