[Patch net-next] net_sched: fix a crash in tc_new_tfilter()

[Cong Wang]

When tcf_block_find() fails, it already rollbacks the qdisc refcnt,
so its caller doesn't need to clean up this again. Avoid calling
qdisc_put() again by resetting qdisc to NULL for callers.

Reported-by: syzbot+37b8770e6d5a8220a...@syzkaller.appspotmail.com
Fixes: e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl 
lock")
Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
---
 net/sched/cls_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8dd7f8af6d54..a4167ec0a220 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -717,8 +717,10 @@ static struct tcf_block *tcf_block_find(struct net *net, 
struct Qdisc **q,
 errout_rcu:
        rcu_read_unlock();
 errout_qdisc:
-       if (*q)
+       if (*q) {
                qdisc_put(*q);
+               *q = NULL;
+       }
        return ERR_PTR(err);
 }
 
-- 
2.14.4