Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ba08b00 authored by Jarek Poplawski's avatar Jarek Poplawski Committed by David S. Miller
Browse files

sch_htb: remove from event queue in htb_parent_to_leaf() 



There is lack of removing a class from the event queue while changing
from parent to leaf which can cause corruption of this rb tree. This
patch fixes a bug introduced by my patch: "sch_htb: turn intermediate
classes into leaves" commit: 160d5e10.

Many thanks to Jan 'yanek' Bortl for finding a way to reproduce this
rare bug and narrowing the test case, which made possible proper
diagnosing.

This patch is recommended for all kernels starting from 2.6.20.

Reported-and-tested-by: default avatarJan 'yanek' Bortl <yanek@ya.bofh.cz>
Signed-off-by: default avatarJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f37f2c62

net/sched/sch_htb.c

+6 −2
Original line number Diff line number Diff line
@@ -1197,12 +1197,16 @@ static inline int htb_parent_last_child(struct htb_class *cl) 
	return 1;

}



static void htb_parent_to_leaf(struct htb_class *cl, struct Qdisc *new_q)

static void htb_parent_to_leaf(struct htb_sched *q, struct htb_class *cl,

			       struct Qdisc *new_q)

{

	struct htb_class *parent = cl->parent;



	BUG_TRAP(!cl->level && cl->un.leaf.q && !cl->prio_activity);



	if (parent->cmode != HTB_CAN_SEND)

		htb_safe_rb_erase(&parent->pq_node, q->wait_pq + parent->level);



	parent->level = 0;

	memset(&parent->un.inner, 0, sizeof(parent->un.inner));

	INIT_LIST_HEAD(&parent->un.leaf.drop_list);
@@ -1300,7 +1304,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) 
		htb_deactivate(q, cl);



	if (last_child)

		htb_parent_to_leaf(cl, new_q);

		htb_parent_to_leaf(q, cl, new_q);



	if (--cl->refcnt == 0)

		htb_destroy_class(sch, cl);