Re: [PATCH v2] net: sched: fix crash when deleting secondary chains

2017-11-23 Thread David Miller
From: Roman Kapl Date: Mon, 20 Nov 2017 22:21:13 +0100 > If you flush (delete) a filter chain other than chain 0 (such as when > deleting the device), the kernel may run into a use-after-free. The > chain refcount must not be decremented unless we are sure we are done > with the

[PATCH v2] net: sched: fix crash when deleting secondary chains

2017-11-20 Thread Roman Kapl
If you flush (delete) a filter chain other than chain 0 (such as when deleting the device), the kernel may run into a use-after-free. The chain refcount must not be decremented unless we are sure we are done with the chain. To reproduce the bug, run: ip link add dtest type dummy tc qdisc

Re: [PATCH v2] net: sched: fix crash when deleting secondary chains

2017-11-20 Thread Cong Wang
On Sun, Nov 19, 2017 at 9:36 AM, Roman Kapl wrote: > If you flush (delete) a filter chain other than chain 0 (such as when > deleting the device), the kernel may run into a use-after-free. The > chain refcount must not be decremented unless we are sure we are done > with the chain.