diff options
| author | Jesus Sanchez-Palencia <jesus.sanchez-palencia@intel.com> | 2017-10-16 18:01:23 -0700 |
|---|---|---|
| committer | Jeff Kirsher <jeffrey.t.kirsher@intel.com> | 2017-10-27 09:41:38 -0700 |
| commit | 26aa0459fad28725aa0bc12a3615cc9a0bd7118f (patch) | |
| tree | 60cc263a4854d9fdf026cbc72a728cfb0ffd163f /net/sched | |
| parent | c859e21a35ce5604dde0b618169680aa3c7e3bdb (diff) | |
| download | linux-26aa0459fad28725aa0bc12a3615cc9a0bd7118f.tar.gz linux-26aa0459fad28725aa0bc12a3615cc9a0bd7118f.tar.bz2 linux-26aa0459fad28725aa0bc12a3615cc9a0bd7118f.zip | |
net/sched: Check for null dev_queue on create flow
In qdisc_alloc() the dev_queue pointer was used without any checks
being performed. If qdisc_create() gets a null dev_queue pointer, it
just passes it along to qdisc_alloc(), leading to a crash. That
happens if a root qdisc implements select_queue() and returns a null
dev_queue pointer for an "invalid handle", for example, or if the
dev_queue associated with the parent qdisc is null.
This patch is in preparation for the next in this series, where
select_queue() is being added to mqprio and as it may return a null
dev_queue.
Signed-off-by: Jesus Sanchez-Palencia <jesus.sanchez-palencia@intel.com>
Tested-by: Henrik Austad <henrik@austad.us>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/sch_generic.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 6ced7c89c141..aa74aa42b5d7 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -603,8 +603,14 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue, struct Qdisc *sch; unsigned int size = QDISC_ALIGN(sizeof(*sch)) + ops->priv_size; int err = -ENOBUFS; - struct net_device *dev = dev_queue->dev; + struct net_device *dev; + + if (!dev_queue) { + err = -EINVAL; + goto errout; + } + dev = dev_queue->dev; p = kzalloc_node(size, GFP_KERNEL, netdev_queue_numa_node_read(dev_queue)); |