diff options
| author | Nikolay Aleksandrov <nikolay@cumulusnetworks.com> | 2017-08-30 12:49:00 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-11-11 13:34:36 +0000 |
| commit | c80cb643423d8ea1748f57c51480742f554830ec (patch) | |
| tree | 439e5a2910e7e04efbffd78cfd4541179c55664e /net | |
| parent | 1c2197aa2ed034eb01faf94aa0b4e3a972216244 (diff) | |
| download | linux-c80cb643423d8ea1748f57c51480742f554830ec.tar.gz linux-c80cb643423d8ea1748f57c51480742f554830ec.tar.bz2 linux-c80cb643423d8ea1748f57c51480742f554830ec.zip | |
sch_hfsc: fix null pointer deref and double free on init failure
commit 3bdac362a2f89ed3e148fa6f38c5f5d858f50b1a upstream.
Depending on where ->init fails we can get a null pointer deref due to
uninitialized hires timer (watchdog) or a double free of the qdisc hash
because it is already freed by ->destroy().
Fixes: 8d5537387505 ("net/sched/hfsc: allocate tcf block for hfsc root class")
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: sch_hfsc doesn't use a tcf block]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_hfsc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c index 6488e6425652..a239d0aac5ae 100644 --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -1435,6 +1435,8 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt) struct tc_hfsc_qopt *qopt; int err; + qdisc_watchdog_init(&q->watchdog, sch); + if (opt == NULL || nla_len(opt) < sizeof(*qopt)) return -EINVAL; qopt = nla_data(opt); @@ -1460,8 +1462,6 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt) qdisc_class_hash_insert(&q->clhash, &q->root.cl_common); qdisc_class_hash_grow(sch, &q->clhash); - qdisc_watchdog_init(&q->watchdog, sch); - return 0; } |