From: Jamal Hadi Salim
Date: Sun, 7 Oct 2018 07:40:17 -0400
> From: Al Viro
>
> cls_u32.c misuses refcounts for struct tc_u_hnode - it counts references
> via ->hlist and via ->tp_root together. u32_destroy() drops the former
> and, in case when there had been links, leaves the sucker on the
From: Al Viro
cls_u32.c misuses refcounts for struct tc_u_hnode - it counts references
via ->hlist and via ->tp_root together. u32_destroy() drops the former
and, in case when there had been links, leaves the sucker on the list.
As the result, there's nothing to protect it from getting freed onc
