net/sched: Prevent notify to parent who unsupport class ops

If the parent qdisc does not support class operations then exit notify.

In addition, the validity of the cl value is judged before executing the
notify. Similarly, the notify is exited when the address represented by
its value is invalid.

Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
Tested-by: [email protected]
Signed-off-by: Lizhi Xu <[email protected]>
Signed-off-by: NipaLocal <nipa@local>

Author: Lizhi Xu

net/sched/sch_api.c

@@ -808,12 +808,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
 			break;
 		}
 		cops = sch->ops->cl_ops;
-		if (notify && cops->qlen_notify) {
+		if (notify && cops && cops->qlen_notify) {
 			/* Note that qlen_notify must be idempotent as it may get called
 			 * multiple times.
 			 */
 			cl = cops->find(sch, parentid);
-			cops->qlen_notify(sch, cl);
+			if (cl)
+				cops->qlen_notify(sch, cl);
 		}
 		sch->q.qlen -= n;
 		sch->qstats.backlog -= len;