From: Jakub Kicinski <jakub.kicinski@netronome.com>
To: davem@davemloft.net, xiyou.wangcong@gmail.com
Cc: stephen@networkplumber.org, jhs@mojatatu.com, jiri@resnulli.us,
netem@lists.linux-foundation.org, netdev@vger.kernel.org,
oss-drivers@netronome.com, edumazet@google.com, posk@google.com,
nhorman@tuxdriver.com
Subject: [PATCH net v2 0/2] net: netem: fix issues with corrupting GSO frames
Date: Mon, 17 Jun 2019 11:11:09 -0700 [thread overview]
Message-ID: <20190617181111.5025-1-jakub.kicinski@netronome.com> (raw)
Hi!
Corrupting GSO frames currently leads to crashes, due to skb use
after free. These stem from the skb list handling - the segmented
skbs come back on a list, and this list is not properly unlinked
before enqueuing the segments. Turns out this condition is made
very likely to occur because of another bug - in backlog accounting.
Segments are counted twice, which means qdisc's limit gets reached
leading to drops and making the use after free very likely to happen.
The bugs are fixed in order in which they were added to the tree.
Jakub Kicinski (2):
net: netem: fix backlog accounting for corrupted GSO frames
net: netem: fix use after free and double free with packet corruption
net/sched/sch_netem.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
--
2.21.0
next reply other threads:[~2019-06-17 18:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-17 18:11 Jakub Kicinski [this message]
2019-06-17 18:11 ` [PATCH net v2 1/2] net: netem: fix backlog accounting for corrupted GSO frames Jakub Kicinski
2019-06-17 22:32 ` Cong Wang
2019-06-17 18:11 ` [PATCH net v2 2/2] net: netem: fix use after free and double free with packet corruption Jakub Kicinski
2019-06-17 22:33 ` Cong Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190617181111.5025-1-jakub.kicinski@netronome.com \
--to=jakub.kicinski@netronome.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=netdev@vger.kernel.org \
--cc=netem@lists.linux-foundation.org \
--cc=nhorman@tuxdriver.com \
--cc=oss-drivers@netronome.com \
--cc=posk@google.com \
--cc=stephen@networkplumber.org \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).