Commit 52e04294 authored Oct 28, 2022 by Dan Carpenter Committed by Greg Kroah-Hartman Nov 10, 2022

net: sched: Fix use after free in red_enqueue()



[ Upstream commit 8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9 ]

We can't use "skb" again after passing it to qdisc_enqueue().  This is
basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
len before calling child enqueue").

Fixes: d7f4f332 ("sch_red: update backlog as well")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent d605da3e

net/sched/sch_red.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -59,6 +59,7 @@ static int red_enqueue(struct sk_buff skb, struct Qdisc sch,
		{
		struct red_sched_data *q = qdisc_priv(sch);
		struct Qdisc *child = q->qdisc;
		unsigned int len;
		int ret;

		q->vars.qavg = red_calc_qavg(&q->parms,
		@@ -94,9 +95,10 @@ static int red_enqueue(struct sk_buff skb, struct Qdisc sch,
		break;
		}

		len = qdisc_pkt_len(skb);
		ret = qdisc_enqueue(skb, child, to_free);
		if (likely(ret == NET_XMIT_SUCCESS)) {
		qdisc_qstats_backlog_inc(sch, skb);
		sch->qstats.backlog += len;
		sch->q.qlen++;
		} else if (net_xmit_drop_count(ret)) {
		q->stats.pdrop++;