Commit 5438dd45 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

net_sched: fix error path in red_init() 



When ->init() fails, ->destroy() is called to clean up.
So it is unnecessary to clean up in red_init(), and it
would cause some refcount underflow.

Fixes: aee9caa0 ("net: sched: sch_red: Add qevents "early_drop" and "mark"")
Reported-and-tested-by: default avatar <syzbot+b33c1cb0a30ebdc8a5f9@syzkaller.appspotmail.com>
Reported-and-tested-by: default avatar <syzbot+e5ea5f8a3ecfd4427a1c@syzkaller.appspotmail.com>
Cc: Petr Machata <petrm@mellanox.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: default avatarPetr Machata <petrm@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f272285f

net/sched/sch_red.c

+4 −16
Original line number Diff line number Diff line
@@ -353,23 +353,11 @@ static int red_init(struct Qdisc *sch, struct nlattr *opt, 
			      FLOW_BLOCK_BINDER_TYPE_RED_EARLY_DROP,

			      tb[TCA_RED_EARLY_DROP_BLOCK], extack);

	if (err)

		goto err_early_drop_init;

		return err;



	err = tcf_qevent_init(&q->qe_mark, sch,

	return tcf_qevent_init(&q->qe_mark, sch,

			       FLOW_BLOCK_BINDER_TYPE_RED_MARK,

			       tb[TCA_RED_MARK_BLOCK], extack);

	if (err)

		goto err_mark_init;



	return 0;



err_mark_init:

	tcf_qevent_destroy(&q->qe_early_drop, sch);

err_early_drop_init:

	del_timer_sync(&q->adapt_timer);

	red_offload(sch, false);

	qdisc_put(q->qdisc);

	return err;

}



static int red_change(struct Qdisc *sch, struct nlattr *opt,