Unverified Commit 0edd0f75 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2169 net: sched: sch_qfq: Fix UAF in qfq_dequeue() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QKNCRH2CHJ3WLY77M2HOXYAMM7FBRXDI/ 
 
https://gitee.com/src-openeuler/kernel/issues/I80USB 
 
Link:https://gitee.com/openeuler/kernel/pulls/2169

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents f92cb357 e0fa4f24

net/sched/sch_plug.c

+1 −1
Original line number Diff line number Diff line
@@ -210,7 +210,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = { 
	.priv_size   =       sizeof(struct plug_sched_data),

	.enqueue     =       plug_enqueue,

	.dequeue     =       plug_dequeue,

	.peek        =       qdisc_peek_head,

	.peek        =       qdisc_peek_dequeued,

	.init        =       plug_init,

	.change      =       plug_change,

	.reset       =	     qdisc_reset_queue,

net/sched/sch_qfq.c

+17 −5
Original line number Diff line number Diff line
@@ -976,10 +976,13 @@ static void qfq_update_eligible(struct qfq_sched *q) 
}



/* Dequeue head packet of the head class in the DRR queue of the aggregate. */

static void agg_dequeue(struct qfq_aggregate *agg,

static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,

				   struct qfq_class *cl, unsigned int len)

{

	qdisc_dequeue_peeked(cl->qdisc);

	struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);



	if (!skb)

		return NULL;



	cl->deficit -= (int) len;
@@ -989,6 +992,8 @@ static void agg_dequeue(struct qfq_aggregate *agg, 
		cl->deficit += agg->lmax;

		list_move_tail(&cl->alist, &agg->active);

	}



	return skb;

}



static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
@@ -1134,11 +1139,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch) 
	if (!skb)

		return NULL;



	qdisc_qstats_backlog_dec(sch, skb);

	sch->q.qlen--;



	skb = agg_dequeue(in_serv_agg, cl, len);



	if (!skb) {

		sch->q.qlen++;

		return NULL;

	}



	qdisc_qstats_backlog_dec(sch, skb);

	qdisc_bstats_update(sch, skb);



	agg_dequeue(in_serv_agg, cl, len);

	/* If lmax is lowered, through qfq_change_class, for a class

	 * owning pending packets with larger size than the new value

	 * of lmax, then the following condition may hold.