Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c38c83cb authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NET_SCHED]: sch_htb/sch_hfsc: fix oops in qlen_notify 



During both HTB and HFSC class deletion the class is removed from the
class hash before calling qdisc_tree_decrease_qlen. This makes the
->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL
pointer to ->qlen_notify, causing an oops.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9b2f7bcf

net/sched/sch_hfsc.c

+3 −1
Original line number Diff line number Diff line
@@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg) 


	sch_tree_lock(sch);



	list_del(&cl->hlist);

	list_del(&cl->siblings);

	hfsc_adjust_levels(cl->cl_parent);



	hfsc_purge_queue(sch, cl);

	list_del(&cl->hlist);



	if (--cl->refcnt == 0)

		hfsc_destroy_class(sch, cl);

net/sched/sch_htb.c

+3 −3
Original line number Diff line number Diff line
@@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) 


	sch_tree_lock(sch);



	/* delete from hash and active; remainder in destroy_class */

	hlist_del_init(&cl->hlist);



	if (!cl->level) {

		qlen = cl->un.leaf.q->q.qlen;

		qdisc_reset(cl->un.leaf.q);

		qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);

	}



	/* delete from hash and active; remainder in destroy_class */

	hlist_del_init(&cl->hlist);



	if (cl->prio_activity)

		htb_deactivate(q, cl);