Commit 698285da authored by Davide Caratti's avatar Davide Caratti Committed by Jakub Kicinski
Browse files

net/sched: sch_taprio: ensure to reset/destroy all child qdiscs 



taprio_graft() can insert a NULL element in the array of child qdiscs. As
a consquence, taprio_reset() might not reset child qdiscs completely, and
taprio_destroy() might leak resources. Fix it by ensuring that loops that
iterate over q->qdiscs[] don't end when they find the first NULL item.

Fixes: 44d4775c ("net/sched: sch_taprio: reset child qdiscs before freeing them")
Fixes: 5a781ccb ("tc: Add support for configuring the taprio scheduler")
Suggested-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
Link: https://lore.kernel.org/r/13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent b27f0c78

net/sched/sch_taprio.c

+4 −3
Original line number Diff line number Diff line
@@ -1605,7 +1605,8 @@ static void taprio_reset(struct Qdisc *sch) 


	hrtimer_cancel(&q->advance_timer);

	if (q->qdiscs) {

		for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)

		for (i = 0; i < dev->num_tx_queues; i++)

			if (q->qdiscs[i])

				qdisc_reset(q->qdiscs[i]);

	}

	sch->qstats.backlog = 0;
@@ -1626,7 +1627,7 @@ static void taprio_destroy(struct Qdisc *sch) 
	taprio_disable_offload(dev, q, NULL);



	if (q->qdiscs) {

		for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)

		for (i = 0; i < dev->num_tx_queues; i++)

			qdisc_put(q->qdiscs[i]);



		kfree(q->qdiscs);