Unverified Commit b3982366 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11690 sch/netem: fix use after free in netem_dequeue 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/HV7OD53F5FKOTO67UTMJR7HIPG56PBOX/ 
 
https://gitee.com/src-openeuler/kernel/issues/IARX29 
 
Link:https://gitee.com/openeuler/kernel/pulls/11690

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents ec708b53 05bdabbf

net/sched/sch_netem.c

+4 −5
Original line number Diff line number Diff line
@@ -722,11 +722,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) 


				err = qdisc_enqueue(skb, q->qdisc, &to_free);

				kfree_skb_list(to_free);

				if (err != NET_XMIT_SUCCESS &&

				    net_xmit_drop_count(err)) {

				if (err != NET_XMIT_SUCCESS) {

					if (net_xmit_drop_count(err))

						qdisc_qstats_drop(sch);

					qdisc_tree_reduce_backlog(sch, 1,

								  pkt_len);

					qdisc_tree_reduce_backlog(sch, 1, pkt_len);

				}

				goto tfifo_dequeue;

			}