Commit 8c79f0ea authored by Vinicius Costa Gomes's avatar Vinicius Costa Gomes Committed by David S. Miller

taprio: Fix potencial use of invalid memory during dequeue()

Right now, this isn't a problem, but the next commit allows schedules
to be added during runtime. When a new schedule transitions from the
inactive to the active state ("admin" -> "oper") the previous one can
be freed, if it's freed just after the RCU read lock is released, we
may access an invalid entry.

So, we should take care to protect the dequeue() flow, so all the
places that access the entries are protected by the RCU read lock.
Signed-off-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cd86972a
...@@ -136,8 +136,8 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch) ...@@ -136,8 +136,8 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch)
{ {
struct taprio_sched *q = qdisc_priv(sch); struct taprio_sched *q = qdisc_priv(sch);
struct net_device *dev = qdisc_dev(sch); struct net_device *dev = qdisc_dev(sch);
struct sk_buff *skb = NULL;
struct sched_entry *entry; struct sched_entry *entry;
struct sk_buff *skb;
u32 gate_mask; u32 gate_mask;
int i; int i;
...@@ -154,10 +154,9 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch) ...@@ -154,10 +154,9 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch)
* "AdminGateSates" * "AdminGateSates"
*/ */
gate_mask = entry ? entry->gate_mask : TAPRIO_ALL_GATES_OPEN; gate_mask = entry ? entry->gate_mask : TAPRIO_ALL_GATES_OPEN;
rcu_read_unlock();
if (!gate_mask) if (!gate_mask)
return NULL; goto done;
for (i = 0; i < dev->num_tx_queues; i++) { for (i = 0; i < dev->num_tx_queues; i++) {
struct Qdisc *child = q->qdiscs[i]; struct Qdisc *child = q->qdiscs[i];
...@@ -197,16 +196,19 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch) ...@@ -197,16 +196,19 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch)
skb = child->ops->dequeue(child); skb = child->ops->dequeue(child);
if (unlikely(!skb)) if (unlikely(!skb))
return NULL; goto done;
qdisc_bstats_update(sch, skb); qdisc_bstats_update(sch, skb);
qdisc_qstats_backlog_dec(sch, skb); qdisc_qstats_backlog_dec(sch, skb);
sch->q.qlen--; sch->q.qlen--;
return skb; goto done;
} }
return NULL; done:
rcu_read_unlock();
return skb;
} }
static enum hrtimer_restart advance_sched(struct hrtimer *timer) static enum hrtimer_restart advance_sched(struct hrtimer *timer)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment