[PATCH net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs

[PATCH net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs

[Davide Caratti]

taprio_graft() can insert a NULL element in the array of child qdiscs. As
a consquence, taprio_reset() might not reset child qdiscs completely, and
taprio_destroy() might leak resources. Fix it by ensuring that loops that
iterate over q->qdiscs[] don't end when they find the first NULL item.

Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
---
 net/sched/sch_taprio.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c74817ec9964..6f775275826a 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1605,8 +1605,9 @@ static void taprio_reset(struct Qdisc *sch)
 
 	hrtimer_cancel(&q->advance_timer);
 	if (q->qdiscs) {
-		for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
-			qdisc_reset(q->qdiscs[i]);
+		for (i = 0; i < dev->num_tx_queues; i++)
+			if (q->qdiscs[i])
+				qdisc_reset(q->qdiscs[i]);
 	}
 	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
@@ -1626,7 +1627,7 @@ static void taprio_destroy(struct Qdisc *sch)
 	taprio_disable_offload(dev, q, NULL);
 
 	if (q->qdiscs) {
-		for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
+		for (i = 0; i < dev->num_tx_queues; i++)
 			qdisc_put(q->qdiscs[i]);
 
 		kfree(q->qdiscs);
-- 
2.29.2

Re: [PATCH net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu, 17 Dec 2020 22:29:46 +0100 you wrote:
> taprio_graft() can insert a NULL element in the array of child qdiscs. As
> a consquence, taprio_reset() might not reset child qdiscs completely, and
> taprio_destroy() might leak resources. Fix it by ensuring that loops that
> iterate over q->qdiscs[] don't end when they find the first NULL item.
> 
> Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
> Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
> Suggested-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Davide Caratti <dcaratti@redhat.com>
> 
> [...]

Here is the summary with links:
  - [net] net/sched: sch_taprio: ensure to reset/destroy all child qdiscs
    https://git.kernel.org/netdev/net/c/698285da79f5

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html