• Cong Wang's avatar
    net_sched: avoid matching qdisc with zero handle · 50317fce
    Cong Wang authored
    Davide found the following script triggers a NULL pointer
    dereference:
    
    ip l a name eth0 type dummy
    tc q a dev eth0 parent :1 handle 1: htb
    
    This is because for a freshly created netdevice noop_qdisc
    is attached and when passing 'parent :1', kernel actually
    tries to match the major handle which is 0 and noop_qdisc
    has handle 0 so is matched by mistake. Commit 69012ae4
    tries to fix a similar bug but still misses this case.
    
    Handle 0 is not a valid one, should be just skipped. In
    fact, kernel uses it as TC_H_UNSPEC.
    
    Fixes: 69012ae4 ("net: sched: fix handling of singleton qdiscs with qdisc_hash")
    Fixes: 59cc1f61 ("net: sched:convert qdisc linked list to hashtable")
    Reported-by: default avatarDavide Caratti <dcaratti@redhat.com>
    Cc: Jiri Kosina <jkosina@suse.cz>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    50317fce
sch_api.c 47.1 KB