net/sched: Prevent notify to parent who unsupport class ops

If the parent qdisc does not support class operations then exit notify.

In addition, the validity of the cl value is judged before executing the
notify. Similarly, the notify is exited when the address represented by
its value is invalid.

Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1261670bbdefc5485a06
Tested-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Signed-off-by: NipaLocal <nipa@local>

Author: Lizhi Xu

net/sched/sch_api.c

@@ -803,12 +803,13 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
 			break;
 		}
 		cops = sch->ops->cl_ops;
-		if (notify && cops->qlen_notify) {
+		if (notify && cops && cops->qlen_notify) {
 			/* Note that qlen_notify must be idempotent as it may get called
 			 * multiple times.
 			 */
 			cl = cops->find(sch, parentid);
-			cops->qlen_notify(sch, cl);
+			if (cl)
+				cops->qlen_notify(sch, cl);
 		}
 		sch->q.qlen -= n;
 		sch->qstats.backlog -= len;