Hello Dear
From: grace_falli2674 <hidden>
Date: 2012-07-03 03:42:16
Hello Dear My Name is Mavis
Related discussions
- [PATCH v2] net: qrtr: Send HELLO message on endpoint register · 2026-08-20
- [PATCH] net: qrtr: Send HELLO message on endpoint register · 2026-07-31
- Dear netdev@vger.kernel.org, · 2026-07-14
- Hello netdev maintainers, I would like to report a slab-out-of-bounds write reachable through mini_qdisc_pair_swap() during clsact/ingress qdisc teardown, and to propose a fix grounded in an analysis of the actual object lifetimes involved. A first cut at this report suggested a check of the form "miniq_old == &miniqp->miniq1 || miniq_old == &miniqp->miniq2" inside mini_qdisc_pair_swap(); on closer reading of the code that check is incorrect, and the fix belongs in the teardown path instead. Details below. Bug --- KASAN: slab-out-of-bounds Write in mini_qdisc_pair_swap File: net/sched/sch_generic.c Function: mini_qdisc_pair_swap() Affected versions ----------------- - linux-6.1.133 - linux-6.12.91 - mainline (as of this report) Faulting write -------------- Inside mini_qdisc_pair_swap(), at the tail: if (miniq_old) miniq_old->rcu_state = start_poll_synchronize_rcu(); miniq_old is taken from rcu_dereference_protected(*miniqp->p_miniq, 1) and, in a correct... · 2026-06-02