On Fri, Dec 15, 2017 at 3:40 AM, Jiri Pirko [off-list ref] wrote:
From: Jiri Pirko <redacted>
Since in qdisc_create, the destroy op is called when init fails, we
don't do cleanup in init and leave it up to destroy.
This fixes use-after-free when trying to put already freed block.
Fixes: 6e40cf2d4dee ("net: sched: use extended variants of block_get/put in ingress and clsact qdiscs")
Signed-off-by: Jiri Pirko <redacted>
Acked-by: Cong Wang <redacted>