From: Patrick McHardy <kaber@trash.net>
Date: Wed, 27 Sep 2006 23:36:23 +0000 (-0700)
Subject: [NET_SCHED]: HTB: fix incorrect use of RB_EMPTY_NODE
X-Git-Tag: v2.6.19-rc1~858^2~87
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=787e0617e5176176c494a787f1b0a5248a3db568;p=linux-2.6

[NET_SCHED]: HTB: fix incorrect use of RB_EMPTY_NODE

Fix incorrect use of RB_EMPTY_NODE in htb_safe_rb_erase, which makes it
skip nodes within the rbtree instead of nodes not in the tree, resulting
in crashes later on.

The root cause for this seems to be the very counter-intuitive behaviour
of the RB_EMPTY_NODE macro, which returns _false_ when the node is empty.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index bb3ddd4784..6c058e3660 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -391,7 +391,7 @@ static inline void htb_add_class_to_row(struct htb_sched *q,
 /* If this triggers, it is a bug in this code, but it need not be fatal */
 static void htb_safe_rb_erase(struct rb_node *rb, struct rb_root *root)
 {
-	if (RB_EMPTY_NODE(rb)) {
+	if (!RB_EMPTY_NODE(rb)) {
 		WARN_ON(1);
 	} else {
 		rb_erase(rb, root);