Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 53b0f080 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net_sched: Fix qdisc_notify() 

Ben Pfaff reported a kernel oops and provided a test program to
reproduce it.

https://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805



tc_fill_qdisc() should not be called for builtin qdisc, or it
dereference a NULL pointer to get device ifindex.

Fix is to always use tc_qdisc_dump_ignore() before calling
tc_fill_qdisc().

Reported-by: default avatarBen Pfaff <blp@nicira.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a6c0f821

net/sched/sch_api.c

+7 −7
Original line number Original line Diff line number Diff line
@@ -1195,6 +1195,11 @@ nla_put_failure: 
	return -1;

	return -1;

}

}





static bool tc_qdisc_dump_ignore(struct Qdisc *q)

{

	return (q->flags & TCQ_F_BUILTIN) ? true : false;

}



static int qdisc_notify(struct net *net, struct sk_buff *oskb,

static int qdisc_notify(struct net *net, struct sk_buff *oskb,

			struct nlmsghdr *n, u32 clid,

			struct nlmsghdr *n, u32 clid,

			struct Qdisc *old, struct Qdisc *new)

			struct Qdisc *old, struct Qdisc *new)
@@ -1206,11 +1211,11 @@ static int qdisc_notify(struct net *net, struct sk_buff *oskb, 
	if (!skb)

	if (!skb)

		return -ENOBUFS;

		return -ENOBUFS;





	if (old && old->handle) {

	if (old && !tc_qdisc_dump_ignore(old)) {

		if (tc_fill_qdisc(skb, old, clid, pid, n->nlmsg_seq, 0, RTM_DELQDISC) < 0)

		if (tc_fill_qdisc(skb, old, clid, pid, n->nlmsg_seq, 0, RTM_DELQDISC) < 0)

			goto err_out;

			goto err_out;

	}

	}

	if (new) {

	if (new && !tc_qdisc_dump_ignore(new)) {

		if (tc_fill_qdisc(skb, new, clid, pid, n->nlmsg_seq, old ? NLM_F_REPLACE : 0, RTM_NEWQDISC) < 0)

		if (tc_fill_qdisc(skb, new, clid, pid, n->nlmsg_seq, old ? NLM_F_REPLACE : 0, RTM_NEWQDISC) < 0)

			goto err_out;

			goto err_out;

	}

	}
@@ -1223,11 +1228,6 @@ err_out: 
	return -EINVAL;

	return -EINVAL;

}

}





static bool tc_qdisc_dump_ignore(struct Qdisc *q)

{

	return (q->flags & TCQ_F_BUILTIN) ? true : false;

}



static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,

static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,

			      struct netlink_callback *cb,

			      struct netlink_callback *cb,

			      int *q_idx_p, int s_q_idx)

			      int *q_idx_p, int s_q_idx)