Reject empty schedules (num_entries == 0) so next_entry is always valid and RCU readers/timer logic never walk an empty list. taprio enforces the same constraint on schedules (sch_taprio.c, commit 09dbdf28f9f9fa). Fixes: a51c328df310 ("net: qos: introduce a gate control flow action") Signed-off-by: Paul Moses Cc: stable@vger.kernel.org --- net/sched/act_gate.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c index 48ff378bb051a..e4134b9a4a314 100644 --- a/net/sched/act_gate.c +++ b/net/sched/act_gate.c @@ -509,6 +509,12 @@ static int tcf_gate_init(struct net *net, struct nlattr *nla, cycletime_ext = nla_get_u64(tb[TCA_GATE_CYCLE_TIME_EXT]); p->tcfg_cycletime_ext = cycletime_ext; + if (p->num_entries == 0) { + NL_SET_ERR_MSG(extack, "The entry list is empty"); + err = -EINVAL; + goto release_mem; + } + err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack); if (err < 0) goto release_mem; -- 2.52.GIT