Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[NET_SCHED]: sch_htb/sch_hfsc: fix oops in qlen_notify

Browse source 
During both HTB and HFSC class deletion the class is removed from the
class hash before calling qdisc_tree_decrease_qlen. This makes the
->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL
pointer to ->qlen_notify, causing an oops.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy 2007-03-27 14:04:24 -07:00 committed by David S. Miller
parent 9b2f7bcf0e
commit c38c83cb70
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/sched/sch_hfsc.c
View file

@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
sch_tree_lock(sch); sch_tree_lock(sch);
list_del(&cl->hlist);
list_del(&cl->siblings); list_del(&cl->siblings);
hfsc_adjust_levels(cl->cl_parent); hfsc_adjust_levels(cl->cl_parent);
hfsc_purge_queue(sch, cl); hfsc_purge_queue(sch, cl);
list_del(&cl->hlist);
if (--cl->refcnt == 0) if (--cl->refcnt == 0)
hfsc_destroy_class(sch, cl); hfsc_destroy_class(sch, cl);

6
net/sched/sch_htb.c
View file

@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
sch_tree_lock(sch); sch_tree_lock(sch);
/* delete from hash and active; remainder in destroy_class */
hlist_del_init(&cl->hlist);
if (!cl->level) { if (!cl->level) {
qlen = cl->un.leaf.q->q.qlen; qlen = cl->un.leaf.q->q.qlen;
qdisc_reset(cl->un.leaf.q); qdisc_reset(cl->un.leaf.q);
qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen); qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);
} }
/* delete from hash and active; remainder in destroy_class */
hlist_del_init(&cl->hlist);
if (cl->prio_activity) if (cl->prio_activity)
htb_deactivate(q, cl); htb_deactivate(q, cl);