| Message ID | 13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 698285da79f5b0b099db15a37ac661ac408c80eb |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 45 this patch: 45 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 19 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 37 this patch: 37 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Thu, 17 Dec 2020 22:29:46 +0100 you wrote: > taprio_graft() can insert a NULL element in the array of child qdiscs. As > a consquence, taprio_reset() might not reset child qdiscs completely, and > taprio_destroy() might leak resources. Fix it by ensuring that loops that > iterate over q->qdiscs[] don't end when they find the first NULL item. > > Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") > Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") > Suggested-by: Jakub Kicinski <kuba@kernel.org> > Signed-off-by: Davide Caratti <dcaratti@redhat.com> > > [...] Here is the summary with links: - [net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs https://git.kernel.org/netdev/net/c/698285da79f5 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index c74817ec9964..6f775275826a 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -1605,8 +1605,9 @@ static void taprio_reset(struct Qdisc *sch) hrtimer_cancel(&q->advance_timer); if (q->qdiscs) { - for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) - qdisc_reset(q->qdiscs[i]); + for (i = 0; i < dev->num_tx_queues; i++) + if (q->qdiscs[i]) + qdisc_reset(q->qdiscs[i]); } sch->qstats.backlog = 0; sch->q.qlen = 0; @@ -1626,7 +1627,7 @@ static void taprio_destroy(struct Qdisc *sch) taprio_disable_offload(dev, q, NULL); if (q->qdiscs) { - for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) + for (i = 0; i < dev->num_tx_queues; i++) qdisc_put(q->qdiscs[i]); kfree(q->qdiscs);
taprio_graft() can insert a NULL element in the array of child qdiscs. As a consquence, taprio_reset() might not reset child qdiscs completely, and taprio_destroy() might leak resources. Fix it by ensuring that loops that iterate over q->qdiscs[] don't end when they find the first NULL item. Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") Suggested-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Davide Caratti <dcaratti@redhat.com> --- net/sched/sch_taprio.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)