• Zhengchao Shao's avatar
    net: sched: cake: fix null pointer access issue when cake_init() fails · 51f9a892
    Zhengchao Shao authored
    When the default qdisc is cake, if the qdisc of dev_queue fails to be
    inited during mqprio_init(), cake_reset() is invoked to clear
    resources. In this case, the tins is NULL, and it will cause gpf issue.
    
    The process is as follows:
    qdisc_create_dflt()
    	cake_init()
    		q->tins = kvcalloc(...)        --->failed, q->tins is NULL
    	...
    	qdisc_put()
    		...
    		cake_reset()
    			...
    			cake_dequeue_one()
    				b = &q->tins[...]   --->q->tins is NULL
    
    The following is the Call Trace information:
    general protection fault, probably for non-canonical address
    0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    RIP: 0010:cake_dequeue_one+0xc9/0x3c0
    Call Trace:
    <TASK>
    cake_reset+0xb1/0x140
    qdisc_reset+0xed/0x6f0
    qdisc_destroy+0x82/0x4c0
    qdisc_put+0x9e/0xb0
    qdisc_create_dflt+0x2c3/0x4a0
    mqprio_init+0xa71/0x1760
    qdisc_create+0x3eb/0x1000
    tc_modify_qdisc+0x408/0x1720
    rtnetlink_rcv_msg+0x38e/0xac0
    netlink_rcv_skb+0x12d/0x3a0
    netlink_unicast+0x4a2/0x740
    netlink_sendmsg+0x826/0xcc0
    sock_sendmsg+0xc5/0x100
    ____sys_sendmsg+0x583/0x690
    ___sys_sendmsg+0xe8/0x160
    __sys_sendmsg+0xbf/0x160
    do_syscall_64+0x35/0x80
    entry_SYSCALL_64_after_hwframe+0x46/0xb0
    RIP: 0033:0x7f89e5122d04
    </TASK>
    
    Fixes: 046f6fd5 ("sched: Add Common Applications Kept Enhanced (cake) qdisc")
    Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
    Acked-by: default avatarToke Høiland-Jørgensen <toke@toke.dk>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    51f9a892
sch_cake.c 79 KB