Re: [PATCH 2.6 NET] Fixes slab corruption in cbq_destroy

[Patrick McHardy <kaber@xxxxxxxxx>]

Thomas Graf wrote:

> * Patrick McHardy <4149998C.6060501@xxxxxxxxx> 2004-09-16 15:47
>  
>
> > I don't see how there can be slab corruption. qdisc_put_rtab only
> > calls kfree if the table is found in qdisc_rtab_list, which only
> > happens once. But the patch is still fine as cleanup :)
> >    
> On second call to qdisc_put_rtab with tab pointing to an already
> freed qdisc_rate_table:
>
> sch_api.c:271:  if (!tab || --tab->refcnt)
>  
You're right, no double free but accessing and modifying of freed memory.

Regards
Patrick