net/sched: sch_taprio: ensure to reset/destroy all child qdiscs

taprio_graft() can insert a NULL element in the array of child qdiscs. As
a consquence, taprio_reset() might not reset child qdiscs completely, and
taprio_destroy() might leak resources. Fix it by ensuring that loops that
iterate over q->qdiscs[] don't end when they find the first NULL item.

Fixes: a4bb55590292 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
Fixes: 6e8a93ac1aec ("tc: Add support for configuring the taprio scheduler")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://lore.kernel.org/r/13edef6778fef03adc751582562fba4a13e06d6a.1608240532.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c74817ec9964b7eb744f972cca0777111a78f0f2..6f775275826a45a19c519fb06b80c53b304e61ce 100644 (file)
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1605,8 +1605,9 @@ static void taprio_reset(struct Qdisc *sch)
 
        hrtimer_cancel(&q->advance_timer);
        if (q->qdiscs) {
-               for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
-                       qdisc_reset(q->qdiscs[i]);
+               for (i = 0; i < dev->num_tx_queues; i++)
+                       if (q->qdiscs[i])
+                               qdisc_reset(q->qdiscs[i]);
        }
        sch->qstats.backlog = 0;
        sch->q.qlen = 0;
@@ -1626,7 +1627,7 @@ static void taprio_destroy(struct Qdisc *sch)
        taprio_disable_offload(dev, q, NULL);
 
        if (q->qdiscs) {
-               for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++)
+               for (i = 0; i < dev->num_tx_queues; i++)
                        qdisc_put(q->qdiscs[i]);
 
                kfree(q->qdiscs);