net_sched: fix a use-after-free in tc_ctl_tfilter()
net_sched: fix a use-after-free in tc_ctl_tfilter()

When tcf_destroy() returns true, tp could be already destroyed,
we should not use tp->next after that.

For long term, we probably should move tp list to list_head.

Fixes: 1e052be69d04 ("net_sched: destroy proto tp when all filters are gone")
Cc: Jamal Hadi Salim <15cac6df0dbdaecca5b04ed6c5cc9ad59098d331@mojatatu.com>
Signed-off-by: Cong Wang <0f114804888b88d50037b04b42e57b858d851b87@gmail.com>
Acked-by: Jamal Hadi Salim <15cac6df0dbdaecca5b04ed6c5cc9ad59098d331@mojatatu.com>
Signed-off-by: David S. Miller <fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs