diff options
author | Hiroaki SHIMODA <shimoda.hiroaki@gmail.com> | 2014-02-26 16:43:42 +0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-03-24 08:44:01 +0400 |
commit | d93114e2bc720ccc75ff8defe490fbc987935bcb (patch) | |
tree | b34598a2f82144db8ab9fa190d25ffbc19d41ffd /net | |
parent | 4de185063bc4585ef3b56775ec0f8057031f8cd5 (diff) | |
download | linux-d93114e2bc720ccc75ff8defe490fbc987935bcb.tar.xz |
sch_tbf: Fix potential memory leak in tbf_change().
[ Upstream commit 724b9e1d75ab3401aaa081bd4efb440c1b3509db ]
The allocated child qdisc is not freed in error conditions.
Defer the allocation after user configuration turns out to be
valid and acceptable.
Fixes: cc106e441a63b ("net: sched: tbf: fix the calculation of max_size")
Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
-rw-r--r-- | net/sched/sch_tbf.c | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c index 758c3560abb8..bb2c7d5de303 100644 --- a/net/sched/sch_tbf.c +++ b/net/sched/sch_tbf.c @@ -332,18 +332,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate, tb[TCA_TBF_PTAB])); - if (q->qdisc != &noop_qdisc) { - err = fifo_set_limit(q->qdisc, qopt->limit); - if (err) - goto done; - } else if (qopt->limit > 0) { - child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit); - if (IS_ERR(child)) { - err = PTR_ERR(child); - goto done; - } - } - buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U); mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U); @@ -377,6 +365,18 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) goto done; } + if (q->qdisc != &noop_qdisc) { + err = fifo_set_limit(q->qdisc, qopt->limit); + if (err) + goto done; + } else if (qopt->limit > 0) { + child = fifo_create_dflt(sch, &bfifo_qdisc_ops, qopt->limit); + if (IS_ERR(child)) { + err = PTR_ERR(child); + goto done; + } + } + sch_tree_lock(sch); if (child) { qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen); |