diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2017-12-18 23:34:26 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-12-19 20:13:12 +0100 |
| commit | 1df94c3c5dadbce3df6cc0e989d8c85d43a903d6 (patch) | |
| tree | 443baff71ebce34735a8c765852330e6e77f3821 /net | |
| parent | ibmvnic: Include header descriptor support for ARP packets (diff) | |
| download | linux-1df94c3c5dadbce3df6cc0e989d8c85d43a903d6.tar.xz linux-1df94c3c5dadbce3df6cc0e989d8c85d43a903d6.zip | |
net_sched: properly check for empty skb array on error path
First, the check of &q->ring.queue against NULL is wrong, it
is always false. We should check the value rather than the address.
Secondly, we need the same check in pfifo_fast_reset() too,
as both ->reset() and ->destroy() are called in qdisc_destroy().
Fixes: c5ad119fb6c0 ("net: sched: pfifo_fast use skb_array")
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_generic.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 981c08fe810b..876fab2604b8 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -659,6 +659,12 @@ static void pfifo_fast_reset(struct Qdisc *qdisc) struct skb_array *q = band2list(priv, band); struct sk_buff *skb; + /* NULL ring is possible if destroy path is due to a failed + * skb_array_init() in pfifo_fast_init() case. + */ + if (!q->ring.queue) + continue; + while ((skb = skb_array_consume_bh(q)) != NULL) kfree_skb(skb); } @@ -719,7 +725,7 @@ static void pfifo_fast_destroy(struct Qdisc *sch) /* NULL ring is possible if destroy path is due to a failed * skb_array_init() in pfifo_fast_init() case. */ - if (!&q->ring.queue) + if (!q->ring.queue) continue; /* Destroy ring but no need to kfree_skb because a call to * pfifo_fast_reset() has already done that work. |