Toke Høiland-Jørgensen f6bab19931 sched: Avoid dereferencing skb pointer after child enqueue ...

Parent qdiscs may dereference the pointer to the enqueued skb after
enqueue. However, both CAKE and TBF call consume_skb() on the original skb
when splitting GSO packets, leading to a potential use-after-free in the
parent. Fix this by avoiding dereferencing the skb pointer after enqueueing
to the child.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2019-01-15 20:12:00 -08:00

12 KiB

Raw Blame History

View Raw