Re: [PATCH] net/sched: reset block pointer in tcf_block_put()

On Fri, Aug 11, 2017 at 1:32 PM, Florian Westphal [off-list ref] wrote:

Cong Wang [off-list ref] wrote:

quoted

On Thu, Aug 10, 2017 at 2:31 AM, Konstantin Khlebnikov
[off-list ref] wrote:

quoted

In previous API tcf_destroy_chain() could be called several times and
some schedulers like hfsc and atm use that. In new API tcf_block_put()
frees block but leaves stale pointer, second call will free it once again.

Which call path do we call tcf_block_put() for multiple times on
the same block? Please be specific, it is not obvious.

you can use tools/testing/selftests/net/rtnetlink.sh to reproduce this
(kernel panics on delete of root qdisc).

I am sure this is not how changelog works. We have enough space
in changelog to describe a bug, don't have to leave details in a
following-up email which will almost surely be lost in history.