On Wed, Jan 9, 2019 at 12:14 AM Toke Høiland-Jørgensen wrote:
>
> Cong Wang writes:
>
> > On Mon, Jan 7, 2019 at 11:50 AM Toke Høiland-Jørgensen wrote:
> >> @@ -1254,7 +1256,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct
> >> Qdisc *sch,
> >> if (cl->qdisc->q.qlen != 1) {
> >>
On Mon, Jan 7, 2019 at 11:50 AM Toke Høiland-Jørgensen wrote:
> @@ -1254,7 +1256,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct
> Qdisc *sch,
> if (cl->qdisc->q.qlen != 1) {
> if (unlikely(skb == cl->qdisc->ops->peek(cl->qdisc)) &&
Isn't this comparison
Cong Wang writes:
> On Mon, Jan 7, 2019 at 11:50 AM Toke Høiland-Jørgensen wrote:
>> @@ -1254,7 +1256,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct
>> Qdisc *sch,
>> if (cl->qdisc->q.qlen != 1) {
>> if (unlikely(skb == cl->qdisc->ops->peek(cl->qdisc)) &&
>
>
>
From: Toke Høiland-Jørgensen
Parent qdiscs may dereference the pointer to the enqueued skb after
enqueue. However, both CAKE and TBF call consume_skb() on the original skb
when splitting GSO packets, leading to a potential use-after-free in the
parent. Fix this by avoiding dereferencing the skb
