Commit f5c3dd4b authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-sched-init-failure-fixes' 



Nikolay Aleksandrov says:

====================
net/sched: init failure fixes

I went over all qdiscs' init, destroy and reset callbacks and found the
issues fixed in each patch. Mostly they are null pointer dereferences due
to uninitialized timer (qdisc watchdog) or double frees due to ->destroy
cleaning up a second time. There's more information in each patch.
I've tested these by either sending wrong attributes from user-spaces, no
attributes or by simulating memory alloc failure where applicable. Also
tried all of the qdiscs as a default qdisc.

Most of these bugs were present before commit 87b60cfa, I've tried to
include proper fixes tags in each patch.

I haven't included individual patch acks in the set, I'd appreciate it if
you take another look and resend them.
====================

Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f0e82d73 c2d6511e

net/sched/sch_cbq.c

+7 −3
Original line number Diff line number Diff line
@@ -1139,6 +1139,13 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt) 
	struct tc_ratespec *r;

	int err;



	qdisc_watchdog_init(&q->watchdog, sch);

	hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);

	q->delay_timer.function = cbq_undelay;



	if (!opt)

		return -EINVAL;



	err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, NULL);

	if (err < 0)

		return err;
@@ -1177,9 +1184,6 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt) 
	q->link.avpkt = q->link.allot/2;

	q->link.minidle = -0x7FFFFFFF;



	qdisc_watchdog_init(&q->watchdog, sch);

	hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);

	q->delay_timer.function = cbq_undelay;

	q->toplevel = TC_CBQ_MAXLEVEL;

	q->now = psched_get_time();

net/sched/sch_fq_codel.c

+1 −3
Original line number Diff line number Diff line
@@ -491,10 +491,8 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt) 
		if (!q->flows)

			return -ENOMEM;

		q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL);

		if (!q->backlogs) {

			kvfree(q->flows);

		if (!q->backlogs)

			return -ENOMEM;

		}

		for (i = 0; i < q->flows_cnt; i++) {

			struct fq_codel_flow *flow = q->flows + i;

net/sched/sch_hfsc.c

+3 −7
Original line number Diff line number Diff line
@@ -1418,6 +1418,8 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt) 
	struct tc_hfsc_qopt *qopt;

	int err;



	qdisc_watchdog_init(&q->watchdog, sch);



	if (opt == NULL || nla_len(opt) < sizeof(*qopt))

		return -EINVAL;

	qopt = nla_data(opt);
@@ -1430,7 +1432,7 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt) 


	err = tcf_block_get(&q->root.block, &q->root.filter_list);

	if (err)

		goto err_tcf;

		return err;



	q->root.cl_common.classid = sch->handle;

	q->root.refcnt  = 1;
@@ -1448,13 +1450,7 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt) 
	qdisc_class_hash_insert(&q->clhash, &q->root.cl_common);

	qdisc_class_hash_grow(sch, &q->clhash);



	qdisc_watchdog_init(&q->watchdog, sch);



	return 0;



err_tcf:

	qdisc_class_hash_destroy(&q->clhash);

	return err;

}



static int

net/sched/sch_hhf.c

+3 −0
Original line number Diff line number Diff line
@@ -477,6 +477,9 @@ static void hhf_destroy(struct Qdisc *sch) 
		kvfree(q->hhf_valid_bits[i]);

	}



	if (!q->hh_flows)

		return;



	for (i = 0; i < HH_FLOWS_CNT; i++) {

		struct hh_flow_state *flow, *next;

		struct list_head *head = &q->hh_flows[i];

net/sched/sch_htb.c

+3 −2
Original line number Diff line number Diff line
@@ -1017,6 +1017,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) 
	int err;

	int i;



	qdisc_watchdog_init(&q->watchdog, sch);

	INIT_WORK(&q->work, htb_work_func);



	if (!opt)

		return -EINVAL;
@@ -1041,8 +1044,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) 
	for (i = 0; i < TC_HTB_NUMPRIO; i++)

		INIT_LIST_HEAD(q->drops + i);



	qdisc_watchdog_init(&q->watchdog, sch);

	INIT_WORK(&q->work, htb_work_func);

	qdisc_skb_head_init(&q->direct_queue);



	if (tb[TCA_HTB_DIRECT_QLEN])

CRA Git | Maintained and supported by SUSTech CRA and CCSE