diff options
author | Eric Dumazet <eric.dumazet@gmail.com> | 2012-01-04 10:22:24 +0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2012-01-04 23:12:48 +0400 |
commit | bd16a6cce2a7f169b559abc5672fd2c66e91fb36 (patch) | |
tree | a4407fbec170a8ed06bf52a6667d26c4fdd2a124 /net/sched | |
parent | 6cfb5e759d47f037cbd0953ec2c3ceb220ed9e96 (diff) | |
download | linux-bd16a6cce2a7f169b559abc5672fd2c66e91fb36.tar.xz |
net_sched: sfq: fix mem alloc error recovery
Since commit 817fb15dfd98 (net_sched: sfq: allow divisor to be a
parameter), we can leave perturbation timer armed if a memory allocation
error aborts sfq_init().
Memory containing active struct timer_list is freed and kernel can
crash.
Call sfq_destroy() from sfq_init() to properly dismantle qdisc.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched')
-rw-r--r-- | net/sched/sch_sfq.c | 52 |
1 files changed, 33 insertions, 19 deletions
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c index e9d5c911576d..16feb88503af 100644 --- a/net/sched/sch_sfq.c +++ b/net/sched/sch_sfq.c @@ -544,10 +544,38 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) return 0; } +static void *sfq_alloc(size_t sz) +{ + void *ptr = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN); + + if (!ptr) + ptr = vmalloc(sz); + return ptr; +} + +static void sfq_free(void *addr) +{ + if (addr) { + if (is_vmalloc_addr(addr)) + vfree(addr); + else + kfree(addr); + } +} + +static void sfq_destroy(struct Qdisc *sch) +{ + struct sfq_sched_data *q = qdisc_priv(sch); + + tcf_destroy_chain(&q->filter_list); + q->perturb_period = 0; + del_timer_sync(&q->perturb_timer); + sfq_free(q->ht); +} + static int sfq_init(struct Qdisc *sch, struct nlattr *opt) { struct sfq_sched_data *q = qdisc_priv(sch); - size_t sz; int i; q->perturb_timer.function = sfq_perturbation; @@ -574,12 +602,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) return err; } - sz = sizeof(q->ht[0]) * q->divisor; - q->ht = kmalloc(sz, GFP_KERNEL); - if (!q->ht && sz > PAGE_SIZE) - q->ht = vmalloc(sz); - if (!q->ht) + q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor); + if (!q->ht) { + sfq_destroy(sch); return -ENOMEM; + } for (i = 0; i < q->divisor; i++) q->ht[i] = SFQ_EMPTY_SLOT; @@ -594,19 +621,6 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) return 0; } -static void sfq_destroy(struct Qdisc *sch) -{ - struct sfq_sched_data *q = qdisc_priv(sch); - - tcf_destroy_chain(&q->filter_list); - q->perturb_period = 0; - del_timer_sync(&q->perturb_timer); - if (is_vmalloc_addr(q->ht)) - vfree(q->ht); - else - kfree(q->ht); -} - static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb) { struct sfq_sched_data *q = qdisc_priv(sch); |