Stephen Hemminger c07ff8592d netem: fix return value if duplicate enqueue fails ... There is a bug in netem_enqueue() introduced by commit 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") that can lead to a use-after-free. This commit made netem_enqueue() always return NET_XMIT_SUCCESS when a packet is duplicated, which can cause the parent qdisc's q.qlen to be mistakenly incremented. When this happens qlen_notify() may be skipped on the parent during destruction, leaving a dangling pointer for some classful qdiscs like DRR. There are two ways for the bug happen: - If the duplicated packet is dropped by rootq->enqueue() and then the original packet is also dropped. - If rootq->enqueue() sends the duplicated packet to a different qdisc and the original packet is dropped. In both cases NET_XMIT_SUCCESS is returned even though no packets are enqueued at the netem qdisc. The fix is to defer the enqueue of the duplicate packet until after the original packet has been guaranteed to return NET_XMIT_SUCCESS. Fixes: 5845f70638 ("net: netem: fix skb length BUG_ON in __skb_to_sgvec") Reported-by: Budimir Markovic <markovicbudimir@gmail.com> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20240819175753.5151-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2024-08-20 17:03:34 -07:00
..
6lowpan
9p	Two fixes headed to stable trees:	2024-05-29 09:25:15 -07:00
802
8021q	net: Add struct kernel_ethtool_ts_info	2024-07-15 08:02:26 -07:00
appletalk	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
atm	atm: clean up a put_user() calls	2024-06-14 19:08:50 -07:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-01 15:49:42 -07:00
batman-adv	Revert "batman-adv: prefer kfree_rcu() over call_rcu() with free-only callbacks"	2024-06-12 20:18:00 +02:00
bluetooth	Bluetooth: MGMT: Add error handling to pair_device()	2024-08-15 13:09:35 -04:00
bpf	bpf-next-for-netdev	2024-07-09 17:01:46 +02:00
bridge	netfilter: nf_queue: drop packets with cloned unconfirmed conntracks	2024-08-14 23:37:23 +02:00
caif	net: caif: remove unused structs	2024-06-05 10:18:06 +01:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-06-27 12:14:11 -07:00
ceph	libceph: fix crush_choose_firstn() kernel-doc warnings	2024-07-11 16:33:07 +02:00
core	net: Make USO depend on CSUM offload	2024-08-09 21:58:08 -07:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-06-27 12:14:11 -07:00
devlink	devlink: Constify the 'table_ops' parameter of devl_dpipe_table_register()	2024-06-05 10:24:57 +01:00
dns_resolver
dsa	net: dsa: provide a software untagging function on RX for VLAN-aware bridges	2024-08-16 09:59:32 +01:00
ethernet	netkit: Fix pkt_type override upon netkit pass verdict	2024-05-25 10:48:57 -07:00
ethtool	net: ethtool: Allow write mechanism of LPL and both LPL and EPL	2024-08-15 12:20:14 +02:00
handshake	net/handshake: remove redundant assignment to variable ret	2024-04-16 17:14:55 -07:00
hsr	net: hsr: cosmetic: Remove extra white space	2024-06-19 17:32:57 -07:00
ieee802154	bpf-next-for-netdev	2024-05-28 07:27:29 -07:00
ife
ipv4	tcp: prevent concurrent execution of tcp_sk_exit_batch	2024-08-19 08:46:49 -07:00
ipv6	ip6_tunnel: Fix broken GRO	2024-08-20 13:21:10 +02:00
iucv	net/iucv: fix use after free in iucv_sock_close()	2024-07-30 15:01:50 +02:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-08-19 18:36:12 -07:00
key
l2tp	l2tp: fix lockdep splat	2024-08-08 08:28:24 -07:00
l3mdev
lapb
llc	llc: Constify struct llc_sap_state_trans	2024-07-15 08:51:19 -07:00
mac80211	wifi: mac80211: use monitor sdata with driver only if desired	2024-07-26 12:30:49 +02:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-06-03 11:20:56 +02:00
mctp	net: mctp: test: Use correct skb for route input check	2024-08-19 17:48:00 -07:00
mpls	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
mptcp	mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size	2024-08-13 19:13:25 -07:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-01 16:21:44 -07:00
netfilter	netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests	2024-08-14 23:44:55 +02:00
netlabel	netlabel: fix RCU annotation for IPv4 options on socket creation	2024-05-13 14:58:12 -07:00
netlink	net: netlink: remove the cb_mutex "injection" from netlink core	2024-06-10 13:15:40 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-17 13:06:23 +01:00
nfc	Quite smaller than usual. Notably it includes the fix for the unix	2024-05-23 12:49:37 -07:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-04-26 12:20:01 +02:00
openvswitch	net: openvswitch: store sampling probability in cb.	2024-07-05 17:45:47 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-07-15 13:19:17 -07:00
phonet	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
psample	net: psample: fix flag being set in wrong skb	2024-07-11 18:11:31 -07:00
qrtr	net: qrtr: ns: Ignore ENODEV failures in ns	2024-06-14 13:17:21 +02:00
rds	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
rfkill	net: rfkill: Correct return value in invalid parameter case	2024-06-26 10:49:01 +02:00
rose	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-05-09 10:01:01 -07:00
sched	netem: fix return value if duplicate enqueue fails	2024-08-20 17:03:34 -07:00
sctp	sctp: Fix null-ptr-deref in reuseport_add_sock().	2024-08-02 16:25:06 -07:00
smc	net/smc: add the max value of fallback reason count	2024-08-07 19:36:23 -07:00
strparser
sunrpc	nfsd-6.11 fixes:	2024-08-10 10:44:21 -07:00
switchdev	net: bridge: switchdev: Improve error message for port_obj_add/del functions	2024-05-08 12:19:12 +01:00
tipc	A lot of networking people were at a conference last week, busy	2024-07-25 13:32:25 -07:00
tls	net: tls: Pass union tls_crypto_context pointer to memzero_explicit	2024-07-09 11:14:47 -07:00
unix	af_unix: Disable MSG_OOB handling for sockets in sockmap/sockhash	2024-07-17 22:49:00 +02:00
vmw_vsock	vsock: fix recursive ->recvmsg calls	2024-08-15 12:07:04 +02:00
wireless	wifi: cfg80211: correct S1G beacon length calculation	2024-07-26 12:32:47 +02:00
x25	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
xdp	xsk: Require XDP_UMEM_TX_METADATA_LEN to actuate tx_metadata_len	2024-07-25 11:57:27 +02:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-07-15 13:19:17 -07:00
compat.c
devres.c
Kconfig	ethtool: provide customized dim profile management	2024-06-25 17:15:06 -07:00
Kconfig.debug
Makefile
socket.c	net: Split a __sys_listen helper for io_uring	2024-06-19 07:57:21 -06:00
sysctl_net.c	sysctl: Remove check for sentinel element in ctl_table arrays	2024-06-13 10:50:52 +02:00