netdev - Re: SFQ qdisc crashes with limit of 2 packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070918.130957.130617077.davem@davemloft.net>
Date:	Tue, 18 Sep 2007 13:09:57 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	kaber@...sh.net
Cc:	cebbert@...hat.com, netdev@...r.kernel.org, kuznet@....inr.ac.ru
Subject: Re: SFQ qdisc crashes with limit of 2 packets

From: Patrick McHardy <kaber@...sh.net>
Date: Tue, 18 Sep 2007 21:15:28 +0200

> OK the off-by-one prevents an out-of-bounds array access, which
> would cause a crash itself. Despite what I said above, sfq does
> try to handle dequeues while empty, but forgets to update q->tail
> when dropping the last packet from the only active queue, probably
> because it wasn't expected that the queue length is too small to
> queue even a single packet (and that really doesn't make much sense).
> 
> So one possibility for fixing this is to update q->tail in sfq_drop
> when dropping the last packet, but that would still leave the qdisc
> non-functional because of the off-by-one. I chose a different way:
> cap the limit at SFQ_DEPTH-1 and remove the off-by-one, which should
> have no effect on the max (still 127), but prevents the crash since
> we can now queue at least a single packet and q->tail is properly
> updated in sfq_dequeue().
> 
> CCed Alexey just to be safe, but I think the patch should be fine.
> 
> Signed-off-by: Patrick McHardy <kaber@...sh.net>

I've applied this to net-2.6, thanks Patrick.

I'll hold off merging this to Linus until later today so
that if some issue is found we can address it.

Thanks.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html