diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2015-07-17 22:38:44 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-07-21 00:25:03 -0700 |
| commit | ff3532f2655b79058fec035ca54fced69a483084 (patch) | |
| tree | 55fd69c3439be010605e609f6a892e7e3795608e /sound | |
| parent | f6bfc46da6292b630ba389592123f0dd02066172 (diff) | |
| download | talos-op-linux-ff3532f2655b79058fec035ca54fced69a483084.tar.gz talos-op-linux-ff3532f2655b79058fec035ca54fced69a483084.zip | |
sched: cls_flower: fix panic on filter replace
The following test case causes a NULL pointer dereference in cls_flower:
tc filter add dev foo parent 1: flower eth_type ipv4 action ok flowid 1:1
tc filter replace dev foo parent 1: pref 49152 handle 0x1 \
flower eth_type ipv6 action ok flowid 1:1
The problem is that commit 77b9900ef53a ("tc: introduce Flower classifier")
accidentally swapped the arguments of list_replace_rcu(), the old
element needs to be the first argument and the new element the second.
Fixes: 77b9900ef53a ("tc: introduce Flower classifier")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions
