Thread (8 messages) 8 messages, 3 authors, 2020-02-06

Re: [PATCH net] net: sched: prevent a use after free

From: Cong Wang <hidden>
Date: 2020-02-01 19:38:57
Also in: kernel-janitors

On Thu, Jan 30, 2020 at 10:57 PM Dan Carpenter [off-list ref] wrote:
quoted hunk ↗ jump to hunk
The code calls kfree_skb(skb); and then re-uses "skb" on the next line.
Let's re-order these lines to solve the problem.

Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler")
Signed-off-by: Dan Carpenter <redacted>
---
 net/sched/sch_fq_pie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
index bbd0dea6b6b9..78472e0773e9 100644
--- a/net/sched/sch_fq_pie.c
+++ b/net/sched/sch_fq_pie.c
@@ -349,9 +349,9 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt,
        while (sch->q.qlen > sch->limit) {
                struct sk_buff *skb = fq_pie_qdisc_dequeue(sch);

-               kfree_skb(skb);
                len_dropped += qdisc_pkt_len(skb);
                num_dropped += 1;
+               kfree_skb(skb);
Or even better: use rtnl_kfree_skbs().

Thanks.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help