mbox series

[SRU,OEM-5.14,OEM-5.17,0/1] net: sched: Fix use after free in red_enqueue()

Message ID 20230421013406.33564-1-cengiz.can@canonical.com
Headers show
Series net: sched: Fix use after free in red_enqueue() | expand

Message

Cengiz Can April 21, 2023, 1:34 a.m. UTC 
BugLink: https://bugs.launchpad.net/bugs/2017013

[Impact]
We can't use "skb" again after passing it to qdisc_enqueue(). This is
basically identical to commit 2f09707 ("sch_sfb: Also store skb
len before calling child enqueue").

Fixes: d7f4f33 ("sch_red: update backlog as well")

[Fix]
Cherry picked from upstream.

[Test case]
Compile, boot and basic network functionality tested using ntop.

[Potential regression]
Low. This has been in multiple trees for a while now.

Dan Carpenter (1):
  net: sched: Fix use after free in red_enqueue()

 net/sched/sch_red.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Tim Gardner April 24, 2023, 1:48 p.m. UTC | #1 
On 4/20/23 7:34 PM, Cengiz Can wrote:
> BugLink: https://bugs.launchpad.net/bugs/2017013
> 
> [Impact]
> We can't use "skb" again after passing it to qdisc_enqueue(). This is
> basically identical to commit 2f09707 ("sch_sfb: Also store skb
> len before calling child enqueue").
> 
> Fixes: d7f4f33 ("sch_red: update backlog as well")
> 
> [Fix]
> Cherry picked from upstream.
> 
> [Test case]
> Compile, boot and basic network functionality tested using ntop.
> 
> [Potential regression]
> Low. This has been in multiple trees for a while now.
> 
> Dan Carpenter (1):
>    net: sched: Fix use after free in red_enqueue()
> 
>   net/sched/sch_red.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Timo Aaltonen April 27, 2023, 9:54 a.m. UTC | #2 
Cengiz Can kirjoitti 21.4.2023 klo 4.34:
> BugLink: https://bugs.launchpad.net/bugs/2017013
> 
> [Impact]
> We can't use "skb" again after passing it to qdisc_enqueue(). This is
> basically identical to commit 2f09707 ("sch_sfb: Also store skb
> len before calling child enqueue").
> 
> Fixes: d7f4f33 ("sch_red: update backlog as well")
> 
> [Fix]
> Cherry picked from upstream.
> 
> [Test case]
> Compile, boot and basic network functionality tested using ntop.
> 
> [Potential regression]
> Low. This has been in multiple trees for a while now.
> 
> Dan Carpenter (1):
>    net: sched: Fix use after free in red_enqueue()
> 
>   net/sched/sch_red.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 

applied to oem-5.17, thanks. 5.14 is EOL