No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Stephen Hemminger 759e3e8c4a netem: fix return value if duplicate enqueue fails
[ Upstream commit c07ff8592d57ed258afee5a5e04991a48dbaf382 ]

There is a bug in netem_enqueue() introduced by
commit 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
that can lead to a use-after-free.

This commit made netem_enqueue() always return NET_XMIT_SUCCESS
when a packet is duplicated, which can cause the parent qdisc's q.qlen
to be mistakenly incremented. When this happens qlen_notify() may be
skipped on the parent during destruction, leaving a dangling pointer
for some classful qdiscs like DRR.

There are two ways for the bug happen:

- If the duplicated packet is dropped by rootq->enqueue() and then
  the original packet is also dropped.
- If rootq->enqueue() sends the duplicated packet to a different qdisc
  and the original packet is dropped.

In both cases NET_XMIT_SUCCESS is returned even though no packets
are enqueued at the netem qdisc.

The fix is to defer the enqueue of the duplicate packet until after
the original packet has been guaranteed to return NET_XMIT_SUCCESS.

Fixes: 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-04 13:15:00 +02:00
arch openrisc: Call setup_memory() earlier in the init sequence 2024-09-04 13:14:57 +02:00
block block: prevent division by zero in blk_rq_stat_sum() 2024-04-13 12:51:38 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: ecrdsa - Fix module auto-load on add_key 2024-06-16 13:28:51 +02:00
Documentation overflow: Implement size_t saturating arithmetic helpers 2024-09-04 13:14:51 +02:00
drivers net: dsa: mv88e6xxx: Fix out-of-bound access 2024-09-04 13:15:00 +02:00
fs ext4: set the type of max_zeroout to unsigned int to avoid overflow 2024-09-04 13:14:57 +02:00
include kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:14:59 +02:00
init init: open /initrd.image with O_LARGEFILE 2024-04-13 12:51:36 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:23:06 +01:00
kernel hrtimer: Prevent queuing of hrtimer without a function callback 2024-09-04 13:14:58 +02:00
lib overflow: Implement size_t saturating arithmetic helpers 2024-09-04 13:14:51 +02:00
LICENSES
mm memcg_write_event_control(): fix a user-triggerable oops 2024-09-04 13:14:50 +02:00
net netem: fix return value if duplicate enqueue fails 2024-09-04 13:15:00 +02:00
samples media: rename VFL_TYPE_GRABBER to _VIDEO 2024-03-26 18:22:22 -04:00
scripts kbuild: Fix '-S -c' in x86 stack protector scripts 2024-08-19 05:33:53 +02:00
security selinux: fix potential counting error in avc_add_xperms_decision() 2024-09-04 13:14:50 +02:00
sound ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7 2024-09-04 13:14:53 +02:00
tools tc-testing: don't access non-existent variable on exception 2024-09-04 13:14:59 +02:00
usr
virt KVM: async_pf: Cleanup kvm_setup_async_pf() 2024-05-02 16:18:32 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile Linux 5.4.282 2024-08-19 05:33:54 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.