[NET_SCHED]: Fix filter double free

[linux-2.6] / net / sched / sch_cbq.c

diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 414a97c962f188f9ff82ec232119f28bc9a31ebe..ee2d5967d109bdd61c7eb67c4ec04d585974b1f5 100644 (file)
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1717,23 +1717,13 @@ static unsigned long cbq_get(struct Qdisc *sch, u32 classid)
        return 0;
 }
 
-static void cbq_destroy_filters(struct cbq_class *cl)
-{
-       struct tcf_proto *tp;
-
-       while ((tp = cl->filter_list) != NULL) {
-               cl->filter_list = tp->next;
-               tcf_destroy(tp);
-       }
-}
-
 static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
 {
        struct cbq_sched_data *q = qdisc_priv(sch);
 
        BUG_TRAP(!cl->filters);
 
-       cbq_destroy_filters(cl);
+       tcf_destroy_chain(cl->filter_list);
        qdisc_destroy(cl->q);
        qdisc_put_rtab(cl->R_tab);
 #ifdef CONFIG_NET_ESTIMATOR
@@ -1758,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch)
         * classes from root to leafs which means that filters can still
         * be bound to classes which have been destroyed already. --TGR '04
         */
-       for (h = 0; h < 16; h++)
-               for (cl = q->classes[h]; cl; cl = cl->next)
-                       cbq_destroy_filters(cl);
-
+       for (h = 0; h < 16; h++) {
+               for (cl = q->classes[h]; cl; cl = cl->next) {
+                       tcf_destroy_chain(cl->filter_list);
+                       cl->filter_list = NULL;
+               }
+       }
        for (h = 0; h < 16; h++) {
                struct cbq_class *next;