No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Toke Høiland-Jørgensen 279c7668e3 sch_sfb: Don't assume the skb is still around after enqueueing to child
[ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ]

The sch_sfb enqueue() routine assumes the skb is still alive after it has
been enqueued into a child qdisc, using the data in the skb cb field in the
increment_qlen() routine after enqueue. However, the skb may in fact have
been freed, causing a use-after-free in this case. In particular, this
happens if sch_cake is used as a child of sfb, and the GSO splitting mode
of CAKE is enabled (in which case the skb will be split into segments and
the original skb freed).

Fix this by copying the sfb cb data to the stack before enqueueing the skb,
and using this stack copy in increment_qlen() instead of the skb pointer
itself.

Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231
Fixes: e13e02a3c6 ("net_sched: SFB flow scheduler")
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-09-15 12:04:55 +02:00
arch ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node 2022-09-15 12:04:55 +02:00
block blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created 2022-08-25 11:17:36 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: drbg - make reseeding from get_random_bytes() synchronous 2022-06-22 14:11:18 +02:00
Documentation x86/bugs: Add "unknown" reporting for MMIO Stale Data 2022-09-05 10:27:45 +02:00
drivers RDMA/hns: Fix supported page size 2022-09-15 12:04:55 +02:00
fs afs: Use the operation issue time instead of the reply time for callbacks 2022-09-15 12:04:55 +02:00
include debugfs: add debugfs_lookup_and_remove() 2022-09-15 12:04:54 +02:00
init random: handle latent entropy and command line from random_init() 2022-06-22 14:11:17 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-14 18:11:41 +02:00
kernel cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock 2022-09-15 12:04:54 +02:00
lib lib/vdso: Mark do_hres() and do_coarse() as __always_inline 2022-09-05 10:27:47 +02:00
LICENSES
mm Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" 2022-09-15 12:04:49 +02:00
net sch_sfb: Don't assume the skb is still around after enqueueing to child 2022-09-15 12:04:55 +02:00
samples
scripts kbuild: Fix include path in scripts/Makefile.modpost 2022-09-05 10:27:45 +02:00
security apparmor: Fix memleak in aa_simple_write_to_buffer() 2022-08-25 11:18:21 +02:00
sound ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() 2022-09-15 12:04:54 +02:00
tools Revert "selftests/bpf: Fix test_align verifier log patterns" 2022-09-05 10:27:39 +02:00
usr
virt KVM: Add infrastructure and macro to mark VM as bugged 2022-08-25 11:18:16 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: co-maintain random.c 2022-06-22 14:11:05 +02:00
Makefile Linux 5.4.212 2022-09-05 10:27:48 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.