summaryrefslogtreecommitdiff
path: root/net/sched/sch_drr.c
diff options
context:
space:
mode:
authorToke Høiland-Jørgensen <toke@redhat.com>2019-01-09 17:09:42 +0100
committerDavid S. Miller <davem@davemloft.net>2019-01-15 20:12:00 -0800
commitf6bab199315b70fd83fe3ee0947bc84c7a35f3d4 (patch)
treec662d696e0bfe2ee2be86cbdf0da095d9d6389ba /net/sched/sch_drr.c
parent80b3671e9377916bf2b02e56113fa7377ce5705a (diff)
sched: Avoid dereferencing skb pointer after child enqueue
Parent qdiscs may dereference the pointer to the enqueued skb after enqueue. However, both CAKE and TBF call consume_skb() on the original skb when splitting GSO packets, leading to a potential use-after-free in the parent. Fix this by avoiding dereferencing the skb pointer after enqueueing to the child. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_drr.c')
-rw-r--r--net/sched/sch_drr.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index cdebaed0f8cf..feaf47178653 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -350,6 +350,7 @@ static struct drr_class *drr_classify(struct sk_buff *skb, struct Qdisc *sch,
static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct sk_buff **to_free)
{
+ unsigned int len = qdisc_pkt_len(skb);
struct drr_sched *q = qdisc_priv(sch);
struct drr_class *cl;
int err = 0;
@@ -376,7 +377,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
cl->deficit = cl->quantum;
}
- qdisc_qstats_backlog_inc(sch, skb);
+ sch->qstats.backlog += len;
sch->q.qlen++;
return err;
}