hello
From: duncan <hidden>
Date: 2017-03-07 17:29:56
hi
Related discussions
- [PATCH v2] net: qrtr: Send HELLO message on endpoint register · 2026-08-13
- [PATCH] net: qrtr: Send HELLO message on endpoint register · 2026-07-31
- Hello netdev maintainers, I would like to report a slab-out-of-bounds write reachable through mini_qdisc_pair_swap() during clsact/ingress qdisc teardown, and to propose a fix grounded in an analysis of the actual object lifetimes involved. A first cut at this report suggested a check of the form "miniq_old == &miniqp->miniq1 || miniq_old == &miniqp->miniq2" inside mini_qdisc_pair_swap(); on closer reading of the code that check is incorrect, and the fix belongs in the teardown path instead. Details below. Bug --- KASAN: slab-out-of-bounds Write in mini_qdisc_pair_swap File: net/sched/sch_generic.c Function: mini_qdisc_pair_swap() Affected versions ----------------- - linux-6.1.133 - linux-6.12.91 - mainline (as of this report) Faulting write -------------- Inside mini_qdisc_pair_swap(), at the tail: if (miniq_old) miniq_old->rcu_state = start_poll_synchronize_rcu(); miniq_old is taken from rcu_dereference_protected(*miniqp->p_miniq, 1) and, in a correct... · 2026-06-02