Xiang Mei
71d84658a6
net/sched: sch_qfq: Fix null-deref in agg_dequeue ...
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)
when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return
value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static
inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to
include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://patch.msgid.link/20250705212143.3982664-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-03 12:45:04 +01:00
net/9p: fix double req put in p9_fd_cancelled
2025-10-29 13:59:54 +01:00
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-02-01 18:18:45 +01:00
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
2025-08-28 16:21:16 +02:00
net: appletalk: Fix use-after-free in AARP proxy probe
2025-08-28 16:21:17 +02:00
net: atm: fix memory leak in atm_register_sysfs when device_register fail
2025-09-09 18:43:58 +02:00
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-09 18:43:58 +02:00
batman-adv: fix OOB read/write in network-coding decode
2025-09-09 18:43:59 +02:00
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
2025-09-09 18:43:57 +02:00
bpfilter: match bit size of bpfilter_umh to that of the kernel
2025-07-17 18:24:51 +02:00
netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
2025-06-27 11:02:46 +01:00
caif: reduce stack size, again
2025-08-28 16:21:19 +02:00
can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
2025-10-02 13:34:29 +02:00
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
2025-10-29 14:00:01 +01:00
net: fix data-races around sk->sk_forward_alloc
2025-02-01 18:18:52 +01:00
net: dsa: microchip: linearize skb for tail-tagging switches
2025-09-09 18:44:00 +02:00
tcp: fix tcp_tso_should_defer() vs large RTT
2025-10-29 13:59:57 +01:00
net/ip6_tunnel: Prevent perpetual tunnel growth
2025-10-29 13:59:56 +01:00
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-06-04 14:32:35 +02:00
wifi: mac80211: fix incorrect type for ret
2025-10-02 13:34:30 +02:00
mac802154: check local interfaces before deleting sdata list
2025-02-01 18:18:50 +01:00
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
2025-06-27 11:02:57 +01:00
net: ncsi: Fix buffer overflow in fetching version id
2025-08-28 16:21:27 +02:00
ipvs: Defer ip_vs_ftp unregister during netns cleanup
2025-10-29 13:59:49 +01:00
calipso: unlock rcu before returning -EAFNOSUPPORT
2025-06-27 11:02:50 +01:00
netlink: avoid infinite retry looping in netlink_unicast()
2025-08-28 16:21:23 +02:00
netrom: check buffer length before accessing it
2025-01-09 13:23:35 +01:00
NFC: nci: uart: Set tty->disc_data only in success path
2025-06-27 11:02:51 +01:00
openvswitch: Fix unsafe attribute parsing in output_userspace()
2025-06-04 14:32:29 +02:00
net/packet: fix a race in packet_set_ring() and packet_notifier()
2025-08-28 16:21:23 +02:00
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
2025-08-28 16:21:14 +02:00
rds: ib: Increment i_fastreg_wrs before bailing out
2025-10-02 13:34:31 +02:00
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
2025-10-02 13:34:32 +02:00
rose: fix dangling neighbour pointers in rose_rt_device_down()
2025-07-17 18:25:00 +02:00
rxrpc: Fix oops due to non-existence of prealloc backlog struct
2025-07-17 18:25:02 +02:00
net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-12-03 12:45:04 +01:00
sctp: avoid NULL dereference when chunk data buffer is missing
2025-10-29 13:59:59 +01:00
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
2025-01-09 13:23:27 +01:00
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
2025-06-27 11:02:58 +01:00
tipc: Fix use-after-free in tipc_conn_close().
2025-07-17 18:25:01 +02:00
tls: don't rely on tx_work during send()
2025-10-29 13:59:57 +01:00
vsock: Do not allow binding to VMADDR_PORT_ANY
2025-08-28 16:21:23 +02:00
wifi: cfg80211: fix use-after-free in cmp_bss()
2025-09-09 18:43:56 +02:00
xfrm: Sanitize marks before insert
2025-06-04 14:32:35 +02:00
71d84658a6