taprio: Fix potencial use of invalid memory during dequeue() (8c79f0ea) · Commits · 戴 / test

Right now, this isn't a problem, but the next commit allows schedules to be added during runtime. When a new schedule transitions from the inactive to the active state ("admin" -> "oper") the previous one can be freed, if it's freed just after the RCU read lock is released, we may access an invalid entry. So, we should take care to protect the dequeue() flow, so all the places that access the entries are protected by the RCU read lock. Signed-off-by:

Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/sched/sch_taprio.c

+8 −6

Original line number	Diff line number	Diff line
		@@ -136,8 +136,8 @@ static struct sk_buff taprio_dequeue(struct Qdisc sch)
		{
		struct taprio_sched *q = qdisc_priv(sch);
		struct net_device *dev = qdisc_dev(sch);
		struct sk_buff *skb = NULL;
		struct sched_entry *entry;
		struct sk_buff *skb;
		u32 gate_mask;
		int i;

		@@ -154,10 +154,9 @@ static struct sk_buff taprio_dequeue(struct Qdisc sch)
		* "AdminGateSates"
		*/
		gate_mask = entry ? entry->gate_mask : TAPRIO_ALL_GATES_OPEN;
		rcu_read_unlock();

		if (!gate_mask)
		return NULL;
		goto done;

		for (i = 0; i < dev->num_tx_queues; i++) {
		struct Qdisc *child = q->qdiscs[i];
		@@ -197,16 +196,19 @@ static struct sk_buff taprio_dequeue(struct Qdisc sch)

		skb = child->ops->dequeue(child);
		if (unlikely(!skb))
		return NULL;
		goto done;

		qdisc_bstats_update(sch, skb);
		qdisc_qstats_backlog_dec(sch, skb);
		sch->q.qlen--;

		return skb;
		goto done;
		}

		return NULL;
		done:
		rcu_read_unlock();

		return skb;
		}

		static enum hrtimer_restart advance_sched(struct hrtimer *timer)

Admin message