On 15-07-17 01:38 PM, Daniel Borkmann wrote: > The following test case causes a NULL pointer dereference in cls_flow: > > tc filter add dev foo parent 1: handle 0x1 flow hash keys dst action ok > tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ > flow hash keys mark action drop > > To be more precise, actually two different panics are fixed, the first > occurs because tcf_exts_init() is not called on the newly allocated > filter when we do a replace. And the second panic uncovered after that > happens since the arguments of list_replace_rcu() are swapped, the old > element needs to be the first argument and the new element the second. > > Fixes: 70da9f0bf999 ("net: sched: cls_flow use RCU") > Signed-off-by: Daniel Borkmann <dan...@iogearbox.net> > --- > net/sched/cls_flow.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) >
Thanks again, I must have missed running replace tests in these cases. Acked-by: John Fastabend <john.r.fastab...@intel.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html