RDMA/nes: Fix use-after-free in mini_cm_dec_refcnt_listen()

[linux-2.6] / net / sched / sch_api.c

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 8db554d54854405c2a280fe71f32babcea75fc3b..7e3c048ba9b1f1421d74435608924d77d36b50f4 100644 (file)
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -244,7 +244,8 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *ta
                }
        }
 
-       if (tab == NULL || r->rate == 0 || r->cell_log == 0 || nla_len(tab) != 1024)
+       if (tab == NULL || r->rate == 0 || r->cell_log == 0 ||
+           nla_len(tab) != TC_RTAB_SIZE)
                return NULL;
 
        rtab = kmalloc(sizeof(*rtab), GFP_KERNEL);