From mboxrd@z Thu Jan 1 00:00:00 1970 From: Guillaume Chazarain Subject: [PATCH] Fix slab corruption with netem Date: Sat, 15 Jul 2006 02:39:54 +0200 Message-ID: <44B8395A.1050602@yahoo.fr> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------010002090801050605090006" Return-path: Received: from smtp4-g19.free.fr ([212.27.42.30]:42423 "EHLO smtp4-g19.free.fr") by vger.kernel.org with ESMTP id S1945955AbWGOAiw (ORCPT ); Fri, 14 Jul 2006 20:38:52 -0400 Received: from [192.168.0.4] (bar06-2-82-224-157-131.fbx.proxad.net [82.224.157.131]) by smtp4-g19.free.fr (Postfix) with ESMTP id 1D1004DE43 for ; Sat, 15 Jul 2006 02:38:52 +0200 (CEST) To: netdev@vger.kernel.org Sender: netdev-owner@vger.kernel.org List-Id: netdev.vger.kernel.org This is a multi-part message in MIME format. --------------010002090801050605090006 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hello, CONFIG_DEBUG_SLAB found the following bug: netem_enqueue() in sch_netem.c gets a pointer inside a slab object: struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb; But then, the slab object may be freed: skb = skb_unshare(skb, GFP_ATOMIC) cb is still pointing inside the freed skb, so here is a patch to initialize cb later, and make it clear that initializing it sooner is a bad idea. Thanks. -- Guillaume --------------010002090801050605090006 Content-Type: text/x-patch; name="netem_cb_initialization.diff" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="netem_cb_initialization.diff" --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -148,7 +148,8 @@ static int netem_enqueue(struct sk_buff static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch) { struct netem_sched_data *q = qdisc_priv(sch); - struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb; + /* We don't fill cb now as skb_unshare() may invalidate it */ + struct netem_skb_cb *cb = NULL; struct sk_buff *skb2; int ret; int count = 1; @@ -200,6 +201,7 @@ static int netem_enqueue(struct sk_buff skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8); } + cb = (struct netem_skb_cb *)skb->cb; if (q->gap == 0 /* not doing reordering */ || q->counter < q->gap /* inside last reordering gap */ || q->reorder < get_crandom(&q->reorder_cor)) { -- Signed-off-by: Guillaume Chazarain --------------010002090801050605090006--