f6bab199315b70fd83fe3ee0947bc84c7a35f3d4 - kernel/msm-5.4

commit	f6bab199315b70fd83fe3ee0947bc84c7a35f3d4	[log] [tgz]
author	Toke Høiland-Jørgensen <toke@redhat.com>	Wed Jan 09 17:09:42 2019 +0100
committer	David S. Miller <davem@davemloft.net>	Tue Jan 15 20:12:00 2019 -0800
tree	c662d696e0bfe2ee2be86cbdf0da095d9d6389ba
parent	80b3671e9377916bf2b02e56113fa7377ce5705a [diff]

sched: Avoid dereferencing skb pointer after child enqueue

Parent qdiscs may dereference the pointer to the enqueued skb after
enqueue. However, both CAKE and TBF call consume_skb() on the original skb
when splitting GSO packets, leading to a potential use-after-free in the
parent. Fix this by avoiding dereferencing the skb pointer after enqueueing
to the child.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

net/sched/sch_cbs.c[diff]
net/sched/sch_drr.c[diff]
net/sched/sch_dsmark.c[diff]
net/sched/sch_hfsc.c[diff]
net/sched/sch_htb.c[diff]
net/sched/sch_prio.c[diff]
net/sched/sch_qfq.c[diff]
net/sched/sch_tbf.c[diff]

8 files changed

tree: c662d696e0bfe2ee2be86cbdf0da095d9d6389ba