net/sched: sch_taprio: reset child qdiscs before freeing them
authorDavide Caratti <dcaratti@redhat.com>
Wed, 16 Dec 2020 18:33:29 +0000 (19:33 +0100)
committerJakub Kicinski <kuba@kernel.org>
Thu, 17 Dec 2020 18:57:57 +0000 (10:57 -0800)
commit44d4775ca51805b376a8db5b34f650434a08e556
tree36c649188f6e2d3945fce7398242af258c47db0e
parent5b33afee93a1e7665a5ffae027fc66f9376f4ea7
net/sched: sch_taprio: reset child qdiscs before freeing them

syzkaller shows that packets can still be dequeued while taprio_destroy()
is running. Let sch_taprio use the reset() function to cancel the advance
timer and drop all skbs from the child qdiscs.

Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler")
Link: https://syzkaller.appspot.com/bug?id=f362872379bf8f0017fb667c1ab158f2d1e764ae
Reported-by: syzbot+8971da381fb5a31f542d@syzkaller.appspotmail.com
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://lore.kernel.org/r/63b6d79b0e830ebb0283e020db4df3cdfdfb2b94.1608142843.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sched/sch_taprio.c