Commit 26aa0459 authored Oct 16, 2017 by Jesus Sanchez-Palencia Committed by Jeff Kirsher Oct 27, 2017

net/sched: Check for null dev_queue on create flow



In qdisc_alloc() the dev_queue pointer was used without any checks
being performed. If qdisc_create() gets a null dev_queue pointer, it
just passes it along to qdisc_alloc(), leading to a crash. That
happens if a root qdisc implements select_queue() and returns a null
dev_queue pointer for an "invalid handle", for example, or if the
dev_queue associated with the parent qdisc is null.

This patch is in preparation for the next in this series, where
select_queue() is being added to mqprio and as it may return a null
dev_queue.

Signed-off-by: Jesus Sanchez-Palencia <jesus.sanchez-palencia@intel.com>
Tested-by: Henrik Austad <henrik@austad.us>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

parent c859e21a

net/sched/sch_generic.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -603,8 +603,14 @@ struct Qdisc qdisc_alloc(struct netdev_queue dev_queue,
		struct Qdisc *sch;
		unsigned int size = QDISC_ALIGN(sizeof(*sch)) + ops->priv_size;
		int err = -ENOBUFS;
		struct net_device *dev = dev_queue->dev;
		struct net_device *dev;

		if (!dev_queue) {
		err = -EINVAL;
		goto errout;
		}

		dev = dev_queue->dev;
		p = kzalloc_node(size, GFP_KERNEL,
		netdev_queue_numa_node_read(dev_queue));