Merge branch 'tcf_foo_init-NULL-deref'

Davide Caratti says:

====================
net/sched: fix NULL dereference in the error path of .init()

with several TC actions it's possible to see NULL pointer dereference,
when the .init() function calls tcf_idr_alloc(), fails at some point and
then calls tcf_idr_release(): this series fixes all them introducing
non-NULL tests in the .cleanup() function.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

net/sched/act_csum.c

@@ -626,6 +626,7 @@ static void tcf_csum_cleanup(struct tc_action *a)
 	struct tcf_csum_params *params;
 
 	params = rcu_dereference_protected(p->params, 1);
+	if (params)
 		kfree_rcu(params, rcu);
 }
 

net/sched/act_sample.c

@@ -103,6 +103,7 @@ static void tcf_sample_cleanup(struct tc_action *a)
 
 	psample_group = rtnl_dereference(s->psample_group);
 	RCU_INIT_POINTER(s->psample_group, NULL);
+	if (psample_group)
 		psample_group_put(psample_group);
 }
 

net/sched/act_skbmod.c

@@ -190,6 +190,7 @@ static void tcf_skbmod_cleanup(struct tc_action *a)
 	struct tcf_skbmod_params  *p;
 
 	p = rcu_dereference_protected(d->skbmod_p, 1);
+	if (p)
 		kfree_rcu(p, rcu);
 }
 

net/sched/act_tunnel_key.c

@@ -208,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a)
 	struct tcf_tunnel_key_params *params;
 
 	params = rcu_dereference_protected(t->params, 1);
-
+	if (params) {
 		if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
 			dst_release(&params->tcft_enc_metadata->dst);
 
 		kfree_rcu(params, rcu);
+	}
 }
 
 static int tunnel_key_dump_addresses(struct sk_buff *skb,

net/sched/act_vlan.c

@@ -225,6 +225,7 @@ static void tcf_vlan_cleanup(struct tc_action *a)
 	struct tcf_vlan_params *p;
 
 	p = rcu_dereference_protected(v->vlan_p, 1);
+	if (p)
 		kfree_rcu(p, rcu);
 }