Unverified Commit 2844cc2e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1557 net/sched: cls_fw: Fix improper refcount update leads to use-after-free 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/233WCLKDGOFGUPF6WDFRIM426TVBRFML/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7N3N3 
 
Link:https://gitee.com/openeuler/kernel/pulls/1557

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 3feff602 85657d6d

net/sched/cls_fw.c

+5 −5
Original line number Diff line number Diff line
@@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, 
	if (err < 0)

		return err;



	if (tb[TCA_FW_CLASSID]) {

		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);

		tcf_bind_filter(tp, &f->res, base);

	}



	if (tb[TCA_FW_INDEV]) {

		int ret;

		ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack);
@@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, 
	} else if (head->mask != 0xFFFFFFFF)

		return err;



	if (tb[TCA_FW_CLASSID]) {

		f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);

		tcf_bind_filter(tp, &f->res, base);

	}



	return 0;

}