sch_htb: remove from event queue in htb_parent_to_leaf() (3ba08b00) · Commits · 戴 / test

There is lack of removing a class from the event queue while changing from parent to leaf which can cause corruption of this rb tree. This patch fixes a bug introduced by my patch: "sch_htb: turn intermediate classes into leaves" commit: . Many thanks to Jan 'yanek' Bortl for finding a way to reproduce this rare bug and narrowing the test case, which made possible proper diagnosing. This patch is recommended for all kernels starting from 2.6.20. Reported-and-tested-by:

Jan 'yanek' Bortl <yanek@ya.bofh.cz> Signed-off-by:

Jarek Poplawski <jarkao2@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/sched/sch_htb.c

+6 −2

Original line number	Diff line number	Diff line
		@@ -1197,12 +1197,16 @@ static inline int htb_parent_last_child(struct htb_class *cl)
		return 1;
		}

		static void htb_parent_to_leaf(struct htb_class cl, struct Qdisc new_q)
		static void htb_parent_to_leaf(struct htb_sched q, struct htb_class cl,
		struct Qdisc *new_q)
		{
		struct htb_class *parent = cl->parent;

		BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity);

		if (parent->cmode != HTB_CAN_SEND)
		htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);

		parent->level = 0;
		memset(&parent->un.inner, 0, sizeof(parent->un.inner));
		INIT_LIST_HEAD(&parent->un.leaf.drop_list);
		@@ -1300,7 +1304,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
		htb_deactivate(q, cl);

		if (last_child)
		htb_parent_to_leaf(cl, new_q);
		htb_parent_to_leaf(q, cl, new_q);

		if (--cl->refcnt == 0)
		htb_destroy_class(sch, cl);

Admin message