From mboxrd@z Thu Jan  1 00:00:00 1970
From: Cong Wang <xiyou.wangcong@gmail.com>
Subject: Re: [PATCH net-next v6 08/11] net: sched: don't release reference on
 action overwrite
Date: Mon, 13 Aug 2018 16:00:05 -0700
Message-ID: <CAM_iQpV3ftNR6H0CEXQ01T08WTWNig3xcLxSi7joV+W6atAamA@mail.gmail.com>
References: <1530800673-12280-1-git-send-email-vladbu@mellanox.com> <1530800673-12280-9-git-send-email-vladbu@mellanox.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>,
        David Miller <davem@davemloft.net>,
        Jamal Hadi Salim <jhs@mojatatu.com>,
        Jiri Pirko <jiri@resnulli.us>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Yevgeny Kliteynik <kliteyn@mellanox.com>,
        Jiri Pirko <jiri@mellanox.com>
To: Vlad Buslov <vladbu@mellanox.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pg1-f194.google.com ([209.85.215.194]:36525 "EHLO
        mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1730203AbeHNBoh (ORCPT
        <rfc822;netdev@vger.kernel.org>); Mon, 13 Aug 2018 21:44:37 -0400
Received: by mail-pg1-f194.google.com with SMTP id h12-v6so8206847pgs.3
        for <netdev@vger.kernel.org>; Mon, 13 Aug 2018 16:00:18 -0700 (PDT)
In-Reply-To: <1530800673-12280-9-git-send-email-vladbu@mellanox.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Thu, Jul 5, 2018 at 7:24 AM Vlad Buslov <vladbu@mellanox.com> wrote:
> diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
> index 89a761395c94..acea3feae762 100644
> --- a/net/sched/act_ife.c
> +++ b/net/sched/act_ife.c
...
> @@ -548,6 +546,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
>
>                         if (exists)
>                                 spin_unlock_bh(&ife->tcf_lock);
> +                       tcf_idr_release(*a, bind);
> +
>                         kfree(p);
>                         return err;
>                 }

With this change, you seem release it twice when nla_parse_nested() fails
for ACT_P_CREATED case...?

Looks like what you want is the following?

                if (err) {
                        tcf_idr_release(*a, bind);
                        kfree(p);
                        return err;
                }