Daniel Borkmann 32b2f4b196 sched: cls_flow: fix panic on filter replace ... The following test case causes a NULL pointer dereference in cls_flow: tc filter add dev foo parent 1: handle 0x1 flow hash keys dst action ok tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ flow hash keys mark action drop To be more precise, actually two different panics are fixed, the first occurs because tcf_exts_init() is not called on the newly allocated filter when we do a replace. And the second panic uncovered after that happens since the arguments of list_replace_rcu() are swapped, the old element needs to be the first argument and the new element the second. Fixes: 70da9f0bf9 ("net: sched: cls_flow use RCU") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-07-21 00:25:03 -07:00
..
act_api.c
act_bpf.c	tc: act_bpf: fix memory leak	2015-07-15 21:36:35 -07:00
act_connmark.c
act_csum.c
act_gact.c
act_ipt.c
act_mirred.c
act_nat.c
act_pedit.c
act_police.c
act_simple.c
act_skbedit.c
act_vlan.c
cls_api.c
cls_basic.c
cls_bpf.c	sched: cls_bpf: fix panic on filter replace	2015-07-21 00:25:02 -07:00
cls_cgroup.c
cls_flow.c	sched: cls_flow: fix panic on filter replace	2015-07-21 00:25:03 -07:00
cls_flower.c	sched: cls_flower: fix panic on filter replace	2015-07-21 00:25:03 -07:00
cls_fw.c
cls_route.c
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h
cls_tcindex.c
cls_u32.c
em_canid.c
em_cmp.c
em_ipset.c	net: sched: Simplify em_ipset_match	2015-06-18 21:14:28 +02:00
em_meta.c
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-06-24 16:49:49 -07:00
sch_atm.c
sch_blackhole.c
sch_cbq.c
sch_choke.c
sch_codel.c
sch_drr.c
sch_dsmark.c
sch_fifo.c
sch_fq_codel.c	fq_codel: fix return value of fq_codel_drop()	2015-07-15 21:36:35 -07:00
sch_fq.c
sch_generic.c
sch_gred.c
sch_hfsc.c
sch_hhf.c
sch_htb.c
sch_ingress.c
sch_mq.c
sch_mqprio.c
sch_multiq.c
sch_netem.c
sch_pie.c
sch_plug.c
sch_prio.c
sch_qfq.c	pkt_sched: sch_qfq: remove redundant -if- control statement	2015-06-21 09:47:24 -07:00
sch_red.c
sch_sfb.c
sch_sfq.c	net_sched: fix a use-after-free in sfq	2015-07-15 21:36:34 -07:00
sch_tbf.c
sch_teql.c