diff options
| author | Toke Høiland-Jørgensen <toke@redhat.com> | 2019-01-09 19:09:42 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-01-16 07:12:00 +0300 |
| commit | f6bab199315b70fd83fe3ee0947bc84c7a35f3d4 (patch) | |
| tree | c662d696e0bfe2ee2be86cbdf0da095d9d6389ba /net/sched/sch_drr.c | |
| parent | 80b3671e9377916bf2b02e56113fa7377ce5705a (diff) | |
| download | linux-f6bab199315b70fd83fe3ee0947bc84c7a35f3d4.tar.xz | |
sched: Avoid dereferencing skb pointer after child enqueue
Parent qdiscs may dereference the pointer to the enqueued skb after
enqueue. However, both CAKE and TBF call consume_skb() on the original skb
when splitting GSO packets, leading to a potential use-after-free in the
parent. Fix this by avoiding dereferencing the skb pointer after enqueueing
to the child.
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_drr.c')
| -rw-r--r-- | net/sched/sch_drr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c index cdebaed0f8cf..feaf47178653 100644 --- a/net/sched/sch_drr.c +++ b/net/sched/sch_drr.c @@ -350,6 +350,7 @@ static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch, static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { + unsigned int len = qdisc_pkt_len(skb); struct drr_sched *q = qdisc_priv(sch); struct drr_class *cl; int err = 0; @@ -376,7 +377,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch, cl->deficit = cl->quantum; } - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog += len; sch->q.qlen++; return err; } |