net_sched: sfq: fix mem alloc error recovery

Since commit 817fb15dfd98 (net_sched: sfq: allow divisor to be a
parameter), we can leave perturbation timer armed if a memory allocation
error aborts sfq_init().

Memory containing active struct timer_list is freed and kernel can
crash.

Call sfq_destroy() from sfq_init() to properly dismantle qdisc.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index e9d5c911576d7095fad834b8228f3a5d240c56a7..16feb88503afcf22cc1b378db06a3a3212918e37 100644 (file)
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -544,10 +544,38 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
        return 0;
 }
 
+static void *sfq_alloc(size_t sz)
+{
+       void *ptr = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+
+       if (!ptr)
+               ptr = vmalloc(sz);
+       return ptr;
+}
+
+static void sfq_free(void *addr)
+{
+       if (addr) {
+               if (is_vmalloc_addr(addr))
+                       vfree(addr);
+               else
+                       kfree(addr);
+       }
+}
+
+static void sfq_destroy(struct Qdisc *sch)
+{
+       struct sfq_sched_data *q = qdisc_priv(sch);
+
+       tcf_destroy_chain(&q->filter_list);
+       q->perturb_period = 0;
+       del_timer_sync(&q->perturb_timer);
+       sfq_free(q->ht);
+}
+
 static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
 {
        struct sfq_sched_data *q = qdisc_priv(sch);
-       size_t sz;
        int i;
 
        q->perturb_timer.function = sfq_perturbation;
@@ -574,12 +602,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
                        return err;
        }
 
-       sz = sizeof(q->ht[0]) * q->divisor;
-       q->ht = kmalloc(sz, GFP_KERNEL);
-       if (!q->ht && sz > PAGE_SIZE)
-               q->ht = vmalloc(sz);
-       if (!q->ht)
+       q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor);
+       if (!q->ht) {
+               sfq_destroy(sch);
                return -ENOMEM;
+       }
        for (i = 0; i < q->divisor; i++)
                q->ht[i] = SFQ_EMPTY_SLOT;
 
@@ -594,19 +621,6 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
        return 0;
 }
 
-static void sfq_destroy(struct Qdisc *sch)
-{
-       struct sfq_sched_data *q = qdisc_priv(sch);
-
-       tcf_destroy_chain(&q->filter_list);
-       q->perturb_period = 0;
-       del_timer_sync(&q->perturb_timer);
-       if (is_vmalloc_addr(q->ht))
-               vfree(q->ht);
-       else
-               kfree(q->ht);
-}
-
 static int sfq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
        struct sfq_sched_data *q = qdisc_priv(sch);