* [PATCH net] net: sched: Fix use after free in red_enqueue()
@ 2022-10-28 15:05 Dan Carpenter
2022-10-28 18:13 ` Eric Dumazet
2022-10-31 12:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2022-10-28 15:05 UTC (permalink / raw)
To: Jamal Hadi Salim, Cong Wang, Toke Høiland-Jørgensen
Cc: Jiri Pirko, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, kernel-janitors, Harshit Mogalapalli
We can't use "skb" again after passing it to qdisc_enqueue(). This is
basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
len before calling child enqueue").
Fixes: d7f4f332f082 ("sch_red: update backlog as well")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Applies to net.
net/sched/sch_red.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a5a401f93c1a..98129324e157 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -72,6 +72,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch,
{
struct red_sched_data *q = qdisc_priv(sch);
struct Qdisc *child = q->qdisc;
+ unsigned int len;
int ret;
q->vars.qavg = red_calc_qavg(&q->parms,
@@ -126,9 +127,10 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch,
break;
}
+ len = qdisc_pkt_len(skb);
ret = qdisc_enqueue(skb, child, to_free);
if (likely(ret == NET_XMIT_SUCCESS)) {
- qdisc_qstats_backlog_inc(sch, skb);
+ sch->qstats.backlog += len;
sch->q.qlen++;
} else if (net_xmit_drop_count(ret)) {
q->stats.pdrop++;
--
2.35.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] net: sched: Fix use after free in red_enqueue()
2022-10-28 15:05 [PATCH net] net: sched: Fix use after free in red_enqueue() Dan Carpenter
@ 2022-10-28 18:13 ` Eric Dumazet
2022-10-31 12:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Eric Dumazet @ 2022-10-28 18:13 UTC (permalink / raw)
To: Dan Carpenter
Cc: Jamal Hadi Salim, Cong Wang, Toke Høiland-Jørgensen,
Jiri Pirko, David S. Miller, Jakub Kicinski, Paolo Abeni, netdev,
kernel-janitors, Harshit Mogalapalli
On Fri, Oct 28, 2022 at 8:05 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> We can't use "skb" again after passing it to qdisc_enqueue(). This is
> basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
> len before calling child enqueue").
>
> Fixes: d7f4f332f082 ("sch_red: update backlog as well")
Reviewed-by: Eric Dumazet <edumazet@google.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] net: sched: Fix use after free in red_enqueue()
2022-10-28 15:05 [PATCH net] net: sched: Fix use after free in red_enqueue() Dan Carpenter
2022-10-28 18:13 ` Eric Dumazet
@ 2022-10-31 12:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-10-31 12:00 UTC (permalink / raw)
To: Dan Carpenter
Cc: jhs, xiyou.wangcong, toke, jiri, davem, edumazet, kuba, pabeni,
netdev, kernel-janitors, harshit.m.mogalapalli
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Fri, 28 Oct 2022 18:05:00 +0300 you wrote:
> We can't use "skb" again after passing it to qdisc_enqueue(). This is
> basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
> len before calling child enqueue").
>
> Fixes: d7f4f332f082 ("sch_red: update backlog as well")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> [...]
Here is the summary with links:
- [net] net: sched: Fix use after free in red_enqueue()
https://git.kernel.org/netdev/net/c/8bdc2acd420c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-10-31 12:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-10-28 15:05 [PATCH net] net: sched: Fix use after free in red_enqueue() Dan Carpenter
2022-10-28 18:13 ` Eric Dumazet
2022-10-31 12:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).