| From foo@baz Sat Sep 26 11:13:07 PDT 2015 |
| From: WANG Cong <xiyou.wangcong@gmail.com> |
| Date: Mon, 13 Jul 2015 12:30:07 -0700 |
| Subject: fq_codel: fix a use-after-free |
| |
| From: WANG Cong <xiyou.wangcong@gmail.com> |
| |
| [ Upstream commit 052cbda41fdc243a8d40cce7ab3a6327b4b2887e ] |
| |
| Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") |
| Cc: John Fastabend <john.fastabend@gmail.com> |
| Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> |
| Signed-off-by: Cong Wang <cwang@twopensource.com> |
| Acked-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/sched/sch_fq_codel.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/sched/sch_fq_codel.c |
| +++ b/net/sched/sch_fq_codel.c |
| @@ -162,10 +162,10 @@ static unsigned int fq_codel_drop(struct |
| skb = dequeue_head(flow); |
| len = qdisc_pkt_len(skb); |
| q->backlogs[idx] -= len; |
| - kfree_skb(skb); |
| sch->q.qlen--; |
| qdisc_qstats_drop(sch); |
| qdisc_qstats_backlog_dec(sch, skb); |
| + kfree_skb(skb); |
| flow->dropped++; |
| return idx; |
| } |
