Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bd16a6cc authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net_sched: sfq: fix mem alloc error recovery 



Since commit 817fb15d (net_sched: sfq: allow divisor to be a
parameter), we can leave perturbation timer armed if a memory allocation
error aborts sfq_init().

Memory containing active struct timer_list is freed and kernel can
crash.

Call sfq_destroy() from sfq_init() to properly dismantle qdisc.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6cfb5e75

net/sched/sch_sfq.c

+33 −19
Original line number Diff line number Diff line
@@ -544,10 +544,38 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) 
	return 0;

}



static void *sfq_alloc(size_t sz)

{

	void *ptr = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN);



	if (!ptr)

		ptr = vmalloc(sz);

	return ptr;

}



static void sfq_free(void *addr)

{

	if (addr) {

		if (is_vmalloc_addr(addr))

			vfree(addr);

		else

			kfree(addr);

	}

}



static void sfq_destroy(struct Qdisc *sch)

{

	struct sfq_sched_data *q = qdisc_priv(sch);



	tcf_destroy_chain(&q->filter_list);

	q->perturb_period = 0;

	del_timer_sync(&q->perturb_timer);

	sfq_free(q->ht);

}



static int sfq_init(struct Qdisc *sch, struct nlattr *opt)

{

	struct sfq_sched_data *q = qdisc_priv(sch);

	size_t sz;

	int i;



	q->perturb_timer.function = sfq_perturbation;
@@ -574,12 +602,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) 
			return err;

	}



	sz = sizeof(q->ht[0]) * q->divisor;

	q->ht = kmalloc(sz, GFP_KERNEL);

	if (!q->ht && sz > PAGE_SIZE)

		q->ht = vmalloc(sz);

	if (!q->ht)

	q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor);

	if (!q->ht) {

		sfq_destroy(sch);

		return -ENOMEM;

	}

	for (i = 0; i < q->divisor; i++)

		q->ht[i] = SFQ_EMPTY_SLOT;
@@ -594,19 +621,6 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) 
	return 0;

}



static void sfq_destroy(struct Qdisc *sch)

{

	struct sfq_sched_data *q = qdisc_priv(sch);



	tcf_destroy_chain(&q->filter_list);

	q->perturb_period = 0;

	del_timer_sync(&q->perturb_timer);

	if (is_vmalloc_addr(q->ht))

		vfree(q->ht);

	else

		kfree(q->ht);

}



static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)

{

	struct sfq_sched_data *q = qdisc_priv(sch);