| Message ID | 20190912172230.9635-1-xiyou.wangcong@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net,v2] net_sched: let qdisc_put() accept NULL pointer | expand |
Thu, Sep 12, 2019 at 07:22:30PM CEST, xiyou.wangcong@gmail.com wrote: >When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL >pointer which leads to a crash in sfb_destroy(). Similar for >sch_dsmark. > >Instead of fixing each separately, Linus suggested to just accept >NULL pointer in qdisc_put(), which would make callers easier. > >(For sch_dsmark, the bug probably exists long before commit >6529eaba33f0.) > >Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") >Reported-by: syzbot+d5870a903591faaca4ae@syzkaller.appspotmail.com >Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> >Cc: Jamal Hadi Salim <jhs@mojatatu.com> >Cc: Jiri Pirko <jiri@resnulli.us> >Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Jiri Pirko <jiri@mellanox.com> Thanks!
From: Cong Wang <xiyou.wangcong@gmail.com> Date: Thu, 12 Sep 2019 10:22:30 -0700 > When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL > pointer which leads to a crash in sfb_destroy(). Similar for > sch_dsmark. > > Instead of fixing each separately, Linus suggested to just accept > NULL pointer in qdisc_put(), which would make callers easier. > > (For sch_dsmark, the bug probably exists long before commit > 6529eaba33f0.) > > Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") > Reported-by: syzbot+d5870a903591faaca4ae@syzkaller.appspotmail.com > Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> > Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable, thanks.
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index ac28f6a5d70e..17bd8f539bc7 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -985,6 +985,9 @@ static void qdisc_destroy(struct Qdisc *qdisc) void qdisc_put(struct Qdisc *qdisc) { + if (!qdisc) + return; + if (qdisc->flags & TCQ_F_BUILTIN || !refcount_dec_and_test(&qdisc->refcnt)) return;
When tcf_block_get() fails in sfb_init(), q->qdisc is still a NULL pointer which leads to a crash in sfb_destroy(). Similar for sch_dsmark. Instead of fixing each separately, Linus suggested to just accept NULL pointer in qdisc_put(), which would make callers easier. (For sch_dsmark, the bug probably exists long before commit 6529eaba33f0.) Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure") Reported-by: syzbot+d5870a903591faaca4ae@syzkaller.appspotmail.com Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> --- net/sched/sch_generic.c | 3 +++ 1 file changed, 3 insertions(+)