RE: [net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-07-02 Thread Keller, Jacob E
hat.com; Eric Dumazet > Subject: Re: [net] fq_codel: fix NULL pointer deref in fq_codel_reset > > On Mon, Jun 11, 2018 at 12:57 PM, Keller, Jacob E > wrote: > > > > I'm open to alternative suggestinos for fixing this, I think Eric suggested > > that > maybe

RE: [net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-06-11 Thread Keller, Jacob E
redhat.com; Eric Dumazet > Subject: Re: [net] fq_codel: fix NULL pointer deref in fq_codel_reset > > Making q->flows_cnt 0 is simpler and easier to understand. Feel free to propose such a patch :) Thanks, Jake

Re: [net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-06-11 Thread Cong Wang
On Mon, Jun 11, 2018 at 12:57 PM, Keller, Jacob E wrote: > > I'm open to alternative suggestinos for fixing this, I think Eric suggested > that maybe we should just remove the ->reset() call from qdisc_destroy..? You can't remove ->reset() for non-failure call path. For failure path, yeah, but

Re: [net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-06-11 Thread Cong Wang
On Mon, Jun 11, 2018 at 10:00 AM, Jeff Kirsher wrote: > > We could mitigate some of these issues by changing fq_codel_init to more > explicitly cleanup after itself when failing. For example, we could > ensure that q->flowcnt was set to 0 so that the loop over each flow in > fq_codel_reset would n

RE: [net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-06-11 Thread Keller, Jacob E
gt; Subject: [net] fq_codel: fix NULL pointer deref in fq_codel_reset > > From: Jacob Keller > > The function qdisc_create_dftl attempts to create a default qdisc. If > this fails, it calls qdisc_destroy when cleaning up. The qdisc_destroy > function calls the ->reset op

[net] fq_codel: fix NULL pointer deref in fq_codel_reset

2018-06-11 Thread Jeff Kirsher
From: Jacob Keller The function qdisc_create_dftl attempts to create a default qdisc. If this fails, it calls qdisc_destroy when cleaning up. The qdisc_destroy function calls the ->reset op on the qdisc. In the case of sch_fq_codel.c, this function will panic when the qdisc wasn't properly initi