Subject: Re: [Patch net] net_sched: fix a use-after-free in tc_ctl_tfilter()

From: Jamal Hadi Salim <[email-masked]>
Date: Wed, 06 May 2015 17:24:53 -0400

On 05/05/15 18:22, Cong Wang wrote:
> When tcf_destroy() returns true, tp could be already destroyed,
> we should not use tp->next after that.
>
> For long term, we probably should move tp list to list_head.
>
> Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone")
> Cc: Jamal Hadi Salim <[email-masked]>
> Signed-off-by: Cong Wang <[email-masked]>

Acked-by: Jamal Hadi Salim <[email-masked]>

cheers,
jamal