sch_hfsc: fix null pointer deref and double free on init failure
commit 3bdac362a2f89ed3e148fa6f38c5f5d858f50b1a upstream. Depending on where ->init fails we can get a null pointer deref due to uninitialized hires timer (watchdog) or a double free of the qdisc hash because it is already freed by ->destroy(). Fixes: 8d5537387505 ("net/sched/hfsc: allocate tcf block for hfsc root class") Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> [bwh: Backported to 3.2: sch_hfsc doesn't use a tcf block] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
4859177649
commit
9eb052df32
|
@ -1436,6 +1436,8 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
|
|||
struct tc_hfsc_qopt *qopt;
|
||||
int err;
|
||||
|
||||
qdisc_watchdog_init(&q->watchdog, sch);
|
||||
|
||||
if (opt == NULL || nla_len(opt) < sizeof(*qopt))
|
||||
return -EINVAL;
|
||||
qopt = nla_data(opt);
|
||||
|
@ -1461,8 +1463,6 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
|
|||
qdisc_class_hash_insert(&q->clhash, &q->root.cl_common);
|
||||
qdisc_class_hash_grow(sch, &q->clhash);
|
||||
|
||||
qdisc_watchdog_init(&q->watchdog, sch);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue