Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 724b9e1d authored by Hiroaki SHIMODA's avatar Hiroaki SHIMODA Committed by David S. Miller
Browse files

sch_tbf: Fix potential memory leak in tbf_change(). 



The allocated child qdisc is not freed in error conditions.
Defer the allocation after user configuration turns out to be
valid and acceptable.

Fixes: cc106e44 ("net: sched: tbf: fix the calculation of max_size")
Signed-off-by: default avatarHiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 09a89c21

net/sched/sch_tbf.c

+12 −12
Original line number Diff line number Diff line
@@ -334,18 +334,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) 
			qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,

						      tb[TCA_TBF_PTAB]));



	if (q->qdisc != &noop_qdisc) {

		err = fifo_set_limit(q->qdisc, qopt->limit);

		if (err)

			goto done;

	} else if (qopt->limit > 0) {

		child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);

		if (IS_ERR(child)) {

			err = PTR_ERR(child);

			goto done;

		}

	}



	buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);

	mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
@@ -390,6 +378,18 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) 
		goto done;

	}



	if (q->qdisc != &noop_qdisc) {

		err = fifo_set_limit(q->qdisc, qopt->limit);

		if (err)

			goto done;

	} else if (qopt->limit > 0) {

		child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit);

		if (IS_ERR(child)) {

			err = PTR_ERR(child);

			goto done;

		}

	}



	sch_tree_lock(sch);

	if (child) {

		qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);