with several TC actions it's possible to see NULL pointer dereference, when the .init() function calls tcf_idr_alloc(), fails at some point and then calls tcf_idr_release(): this series fixes all them introducing non-NULL tests in the .cleanup() function.
Davide Caratti (5): net/sched: fix NULL dereference in the error path of tcf_vlan_init() net/sched: fix NULL dereference in the error path of tcf_csum_init() net/sched: fix NULL dereference in the error path of tunnel_key_init() net/sched: fix NULL dereference in the error path of tcf_sample_init() net/sched: fix NULL dereference on the error path of tcf_skbmod_init() net/sched/act_csum.c | 3 ++- net/sched/act_sample.c | 3 ++- net/sched/act_skbmod.c | 3 ++- net/sched/act_tunnel_key.c | 9 +++++---- net/sched/act_vlan.c | 3 ++- 5 files changed, 13 insertions(+), 8 deletions(-) -- 2.14.3
