Subject: Re: [PATCH 2.6 NET] Fixes slab corruption in cbq_destroy

From: Patrick McHardy <[email-masked]>
Date: Thu, 16 Sep 2004 16:58:26 +0200

Thomas Graf wrote:

>* Patrick McHardy <[email-masked]> 2004-09-16 15:47
>  
>
>>I don't see how there can be slab corruption. qdisc_put_rtab only
>>calls kfree if the table is found in qdisc_rtab_list, which only
>>happens once. But the patch is still fine as cleanup :)
>>    
>>
>
>On second call to qdisc_put_rtab with tab pointing to an already
>freed qdisc_rate_table:
>
>sch_api.c:271:  if (!tab || --tab->refcnt)
>  
>
You're right, no double free but accessing and modifying of freed memory.

Regards
Patrick