diff options
| author | Jarek Poplawski <jarkao2@gmail.com> | 2009-03-16 04:00:19 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-03-16 04:00:19 +0100 |
| commit | 7cd0a63872ac6ef97265f07adc367ca4f984468e (patch) | |
| tree | 44265aa422b3133b07eee87280cca3c89225437a /net/sched/sch_htb.c | |
| parent | net: reorder fields of struct socket (diff) | |
| download | linux-7cd0a63872ac6ef97265f07adc367ca4f984468e.tar.xz linux-7cd0a63872ac6ef97265f07adc367ca4f984468e.zip | |
pkt_sched: Change misleading code in class delete.
While looking for a possible reason of bugzilla report on HTB oops:
http://bugzilla.kernel.org/show_bug.cgi?id=12858
I found the code in htb_delete calling htb_destroy_class on zero
refcount is very misleading: it can suggest this is a common path, and
destroy is called under sch_tree_lock. Actually, this can never happen
like this because before deletion cops->get() is done, and after
delete a class is still used by tclass_notify. The class destroy is
always called from cops->put(), so without sch_tree_lock.
This doesn't mean much now (since 2.6.27) because all vulnerable calls
were moved from htb_destroy_class to htb_delete, but there was a bug
in older kernels. The same change is done for other classful scheds,
which, it seems, didn't have similar locking problems here.
Reported-by: m0sia <m0sia@m0sia.ru>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_htb.c')
| -rw-r--r-- | net/sched/sch_htb.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c index 355974f610c5..88cd02626621 100644 --- a/net/sched/sch_htb.c +++ b/net/sched/sch_htb.c @@ -1275,8 +1275,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) if (last_child) htb_parent_to_leaf(q, cl, new_q); - if (--cl->refcnt == 0) - htb_destroy_class(sch, cl); + BUG_ON(--cl->refcnt == 0); + /* + * This shouldn't happen: we "hold" one cops->get() when called + * from tc_ctl_tclass; the destroy method is done from cops->put(). + */ sch_tree_unlock(sch); return 0; |