From: Daniel Borkmann Date: Fri, 21 Jul 2023 23:33:30 +0000 (+0200) Subject: tcx: Fix splat in ingress_destroy upon tcx_entry_free X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=dc644b540a2d2874112706591234be3d3fbf9ef7;p=linux.git tcx: Fix splat in ingress_destroy upon tcx_entry_free On qdisc destruction, the ingress_destroy() needs to update the correct entry, that is, tcx_entry_update must NULL the dev->tcx_ingress pointer. Therefore, fix the typo. Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support") Reported-by: syzbot+bdcf141f362ef83335cf@syzkaller.appspotmail.com Reported-by: syzbot+b202b7208664142954fa@syzkaller.appspotmail.com Reported-by: syzbot+14736e249bce46091c18@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Tested-by: syzbot+bdcf141f362ef83335cf@syzkaller.appspotmail.com Tested-by: syzbot+b202b7208664142954fa@syzkaller.appspotmail.com Tested-by: syzbot+14736e249bce46091c18@syzkaller.appspotmail.com Tested-by: Petr Machata Link: https://lore.kernel.org/r/20230721233330.5678-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski --- diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c index 04e886f6cee43..a463a63192c3c 100644 --- a/net/sched/sch_ingress.c +++ b/net/sched/sch_ingress.c @@ -123,7 +123,7 @@ static void ingress_destroy(struct Qdisc *sch) if (entry) { tcx_miniq_set_active(entry, false); if (!tcx_entry_is_active(entry)) { - tcx_entry_update(dev, NULL, false); + tcx_entry_update(dev, NULL, true); tcx_entry_free(entry); } }