summaryrefslogtreecommitdiff
path: root/net/sched/sch_cbs.c
diff options
context:
space:
mode:
authorToke Høiland-Jørgensen <toke@redhat.com>2019-01-09 19:09:42 +0300
committerDavid S. Miller <davem@davemloft.net>2019-01-16 07:12:00 +0300
commitf6bab199315b70fd83fe3ee0947bc84c7a35f3d4 (patch)
treec662d696e0bfe2ee2be86cbdf0da095d9d6389ba /net/sched/sch_cbs.c
parent80b3671e9377916bf2b02e56113fa7377ce5705a (diff)
downloadlinux-f6bab199315b70fd83fe3ee0947bc84c7a35f3d4.tar.xz
sched: Avoid dereferencing skb pointer after child enqueue
Parent qdiscs may dereference the pointer to the enqueued skb after enqueue. However, both CAKE and TBF call consume_skb() on the original skb when splitting GSO packets, leading to a potential use-after-free in the parent. Fix this by avoiding dereferencing the skb pointer after enqueueing to the child. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/sch_cbs.c')
-rw-r--r--net/sched/sch_cbs.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index e689e11b6d0f..c6a502933fe7 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -88,13 +88,14 @@ static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
struct Qdisc *child,
struct sk_buff **to_free)
{
+ unsigned int len = qdisc_pkt_len(skb);
int err;
err = child->ops->enqueue(skb, child, to_free);
if (err != NET_XMIT_SUCCESS)
return err;
- qdisc_qstats_backlog_inc(sch, skb);
+ sch->qstats.backlog += len;
sch->q.qlen++;
return NET_XMIT_SUCCESS;