Messages in this thread | | | Subject | Re: [PATCH] net: sched: sch_teql: fix null-pointer dereference | From | Pavel Tikhomirov <> | Date | Thu, 8 Apr 2021 18:51:46 +0300 |
| |
On 4/8/21 6:26 PM, Eric Dumazet wrote: > > > On 4/8/21 5:14 PM, Pavel Tikhomirov wrote: >> Reproduce: >> >> modprobe sch_teql >> tc qdisc add dev teql0 root teql0 >> >> This leads to (for instance in Centos 7 VM) OOPS: >> >> >> >> Null pointer dereference happens on master->slaves dereference in >> teql_destroy() as master is null-pointer. >> >> When qdisc_create() calls teql_qdisc_init() it imediately fails after >> check "if (m->dev == dev)" because both devices are teql0, and it does >> not set qdisc_priv(sch)->m leaving it zero on error path, then >> qdisc_create() imediately calls teql_destroy() which does not expect >> zero master pointer and we get OOPS. >> >> Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> >> --- > > This makes sense, thanks ! > > Reviewed-by: Eric Dumazet <edumazet@google.com>
Thanks!
> > I would think bug origin is > > Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") > > Can you confirm you have this backported to 3.10.0-1062.7.1.el7.x86_64 ? >
According to our source copy it looks backported to 1062.7.1, please see: https://src.openvz.org/projects/OVZ/repos/vzkernel/browse/net/sched/sch_api.c?at=refs%2Ftags%2Frh7-3.10.0-1062.7.1.el7#1167
-- Best regards, Tikhomirov Pavel Software Developer, Virtuozzo.
| |