Unverified Commit 8f315256 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15336 CVE-2025-21702 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/AKAPLNOD5AALD4RY5Z23UYCCYOQWSGDD/ 
Eric Dumazet (1):
  net_sched: sch_fifo: implement lockless __fifo_dump()

Quang Le (1):
  pfifo_tail_enqueue: Drop new packet when sch->limit == 0

 
https://gitee.com/src-openeuler/kernel/issues/IBN6ZL 
 
Link:https://gitee.com/openeuler/kernel/pulls/15336

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 4a34610f a6e5f226

net/sched/sch_fifo.c

+10 −6
Original line number Diff line number Diff line
@@ -22,7 +22,8 @@ 
static int bfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch,

			 struct sk_buff **to_free)

{

	if (likely(sch->qstats.backlog + qdisc_pkt_len(skb) <= sch->limit))

	if (likely(sch->qstats.backlog + qdisc_pkt_len(skb) <=

		   READ_ONCE(sch->limit)))

		return qdisc_enqueue_tail(skb, sch);



	return qdisc_drop(skb, sch, to_free);
@@ -31,7 +32,7 @@ static int bfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch,

			 struct sk_buff **to_free)

{

	if (likely(sch->q.qlen < sch->limit))

	if (likely(sch->q.qlen < READ_ONCE(sch->limit)))

		return qdisc_enqueue_tail(skb, sch);



	return qdisc_drop(skb, sch, to_free);
@@ -42,7 +43,10 @@ static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch, 
{

	unsigned int prev_backlog;



	if (likely(sch->q.qlen < sch->limit))

	if (unlikely(READ_ONCE(sch->limit) == 0))

		return qdisc_drop(skb, sch, to_free);



	if (likely(sch->q.qlen < READ_ONCE(sch->limit)))

		return qdisc_enqueue_tail(skb, sch);



	prev_backlog = sch->qstats.backlog;
@@ -67,14 +71,14 @@ static int fifo_init(struct Qdisc *sch, struct nlattr *opt, 
		if (is_bfifo)

			limit *= psched_mtu(qdisc_dev(sch));



		sch->limit = limit;

		WRITE_ONCE(sch->limit, limit);

	} else {

		struct tc_fifo_qopt *ctl = nla_data(opt);



		if (nla_len(opt) < sizeof(*ctl))

			return -EINVAL;



		sch->limit = ctl->limit;

		WRITE_ONCE(sch->limit, ctl->limit);

	}



	if (is_bfifo)
@@ -91,7 +95,7 @@ static int fifo_init(struct Qdisc *sch, struct nlattr *opt, 


static int fifo_dump(struct Qdisc *sch, struct sk_buff *skb)

{

	struct tc_fifo_qopt opt = { .limit = sch->limit };

	struct tc_fifo_qopt opt = { .limit = READ_ONCE(sch->limit) };



	if (nla_put(skb, TCA_OPTIONS, sizeof(opt), &opt))

		goto nla_put_failure;