Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net_sched: sfq: fix mem alloc error recovery

Browse source 
Since commit 817fb15dfd (net_sched: sfq: allow divisor to be a
parameter), we can leave perturbation timer armed if a memory allocation
error aborts sfq_init().

Memory containing active struct timer_list is freed and kernel can
crash.

Call sfq_destroy() from sfq_init() to properly dismantle qdisc.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2012-01-04 06:22:24 +00:00 committed by David S. Miller
parent 6cfb5e759d
commit bd16a6cce2
1 changed files with 33 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

52
net/sched/sch_sfq.c
View file

@ -544,10 +544,38 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
return 0; return 0;
} }
static void *sfq_alloc(size_t sz)
{
void *ptr = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN);
if (!ptr)
ptr = vmalloc(sz);
return ptr;
}
static void sfq_free(void *addr)
{
if (addr) {
if (is_vmalloc_addr(addr))
vfree(addr);
else
kfree(addr);
}
}
static void sfq_destroy(struct Qdisc *sch)
{
struct sfq_sched_data *q = qdisc_priv(sch);
tcf_destroy_chain(&q->filter_list);
q->perturb_period = 0;
del_timer_sync(&q->perturb_timer);
sfq_free(q->ht);
}
static int sfq_init(struct Qdisc *sch, struct nlattr *opt) static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
{ {
struct sfq_sched_data *q = qdisc_priv(sch); struct sfq_sched_data *q = qdisc_priv(sch);
size_t sz;
int i; int i;
q->perturb_timer.function = sfq_perturbation; q->perturb_timer.function = sfq_perturbation;
@ -574,12 +602,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
return err; return err;
} }
sz = sizeof(q->ht[0]) * q->divisor; q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor);
q->ht = kmalloc(sz, GFP_KERNEL); if (!q->ht) {
if (!q->ht && sz > PAGE_SIZE) sfq_destroy(sch);
q->ht = vmalloc(sz);
if (!q->ht)
return -ENOMEM; return -ENOMEM;
}
for (i = 0; i < q->divisor; i++) for (i = 0; i < q->divisor; i++)
q->ht[i] = SFQ_EMPTY_SLOT; q->ht[i] = SFQ_EMPTY_SLOT;
@ -594,19 +621,6 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
return 0; return 0;
} }
static void sfq_destroy(struct Qdisc *sch)
{
struct sfq_sched_data *q = qdisc_priv(sch);
tcf_destroy_chain(&q->filter_list);
q->perturb_period = 0;
del_timer_sync(&q->perturb_timer);
if (is_vmalloc_addr(q->ht))
vfree(q->ht);
else
kfree(q->ht);
}
static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb) static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
{ {
struct sfq_sched_data *q = qdisc_priv(sch); struct sfq_sched_data *q = qdisc_priv(sch);