]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: sched: Fix use after free in red_enqueue()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 28 Oct 2022 15:05:00 +0000 (18:05 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Nov 2022 14:46:05 +0000 (15:46 +0100)
commit795afe0b9bb6c915f0299a8e309936519be01619
tree707c9f7f2f7ba422050ff08096f38f20670a442d
parente4b7e0dcd13e37b273250d4f334ce9c1b8a1c214
net: sched: Fix use after free in red_enqueue()

[ Upstream commit 8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9 ]

We can't use "skb" again after passing it to qdisc_enqueue().  This is
basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb
len before calling child enqueue").

Fixes: d7f4f332f082 ("sch_red: update backlog as well")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/sched/sch_red.c