Re: [PATCH net] net/sched: sch_ets: don't peek at classes beyond 'nbands'
From: Davide Caratti <hidden>
Date: 2021-11-23 13:03:28
hello, On Tue, Nov 23, 2021 at 12:29 PM Davide Caratti [off-list ref] wrote:
when the number of DRR classes decreases, the round-robin active list can contain elements that have already been freed in ets_qdisc_change(). As a consequence, it's possible to see a NULL dereference crash,
[...]
quoted hunk ↗ jump to hunk
diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c index 0eae9ff5edf6..3b4ae56ebb19 100644 --- a/net/sched/sch_ets.c +++ b/net/sched/sch_ets.c@@ -480,6 +480,10 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch) goto out; cl = list_first_entry(&q->active, struct ets_class, alist); + if (!cl->qdisc) { + list_del(&cl->alist); + goto out;
on a second thought, we probably can do better than 'goto out'. The round-robin list might contain some other entry, so probably it's better to cxheck if the list is now empty, and if not re-do that cl = list_first_entry(&q->active,...) assignment. So, 'dequeue' dequeues the first valid skb in the round robin even after cleaning up those no-more-valid list entries. I will send a v2 in the next minutes. -- davide