From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Mon, 18 Dec 2017 14:34:26 -0800
Subject: net_sched: properly check for empty skb array on error path
Patch-mainline: v4.16-rc1
Git-commit: 1df94c3c5dadbce3df6cc0e989d8c85d43a903d6
References: bsc#1109837
First, the check of &q->ring.queue against NULL is wrong, it
is always false. We should check the value rather than the address.
Secondly, we need the same check in pfifo_fast_reset() too,
as both ->reset() and ->destroy() are called in qdisc_destroy().
Fixes: c5ad119fb6c0 ("net: sched: pfifo_fast use skb_array")
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
net/sched/sch_generic.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -656,6 +656,12 @@ static void pfifo_fast_reset(struct Qdis
struct skb_array *q = band2list(priv, band);
struct sk_buff *skb;
+ /* NULL ring is possible if destroy path is due to a failed
+ * skb_array_init() in pfifo_fast_init() case.
+ */
+ if (!q->ring.queue)
+ continue;
+
while ((skb = skb_array_consume_bh(q)) != NULL)
kfree_skb(skb);
}
@@ -716,7 +722,7 @@ static void pfifo_fast_destroy(struct Qd
/* NULL ring is possible if destroy path is due to a failed
* skb_array_init() in pfifo_fast_init() case.
*/
- if (!&q->ring.queue)
+ if (!q->ring.queue)
continue;
/* Destroy ring but no need to kfree_skb because a call to
* pfifo_fast_reset() has already done that work.