If the parent qdisc does not support class operations then exit notify. In addition, the validity of the cl value is judged before executing the notify. Similarly, the notify is exited when the address represented by its value is invalid. Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06 Tested-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu --- V1 -> V2: movie notify check first and check cl NULL net/sched/sch_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index d8a33486c51..53fd63af14d 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) break; } cops = sch->ops->cl_ops; - if (notify && cops->qlen_notify) { + if (notify && cops && cops->qlen_notify) { /* Note that qlen_notify must be idempotent as it may get called * multiple times. */ cl = cops->find(sch, parentid); - cops->qlen_notify(sch, cl); + if (cl) + cops->qlen_notify(sch, cl); } sch->q.qlen -= n; sch->qstats.backlog -= len; -- 2.43.0