Commit c38c83cb authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller

[NET_SCHED]: sch_htb/sch_hfsc: fix oops in qlen_notify

During both HTB and HFSC class deletion the class is removed from the
class hash before calling qdisc_tree_decrease_qlen. This makes the
->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL
pointer to ->qlen_notify, causing an oops.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9b2f7bcf
...@@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg) ...@@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
sch_tree_lock(sch); sch_tree_lock(sch);
list_del(&cl->hlist);
list_del(&cl->siblings); list_del(&cl->siblings);
hfsc_adjust_levels(cl->cl_parent); hfsc_adjust_levels(cl->cl_parent);
hfsc_purge_queue(sch, cl); hfsc_purge_queue(sch, cl);
list_del(&cl->hlist);
if (--cl->refcnt == 0) if (--cl->refcnt == 0)
hfsc_destroy_class(sch, cl); hfsc_destroy_class(sch, cl);
......
...@@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg) ...@@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
sch_tree_lock(sch); sch_tree_lock(sch);
/* delete from hash and active; remainder in destroy_class */
hlist_del_init(&cl->hlist);
if (!cl->level) { if (!cl->level) {
qlen = cl->un.leaf.q->q.qlen; qlen = cl->un.leaf.q->q.qlen;
qdisc_reset(cl->un.leaf.q); qdisc_reset(cl->un.leaf.q);
qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen); qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);
} }
/* delete from hash and active; remainder in destroy_class */
hlist_del_init(&cl->hlist);
if (cl->prio_activity) if (cl->prio_activity)
htb_deactivate(q, cl); htb_deactivate(q, cl);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment