netdev - Re: SFQ qdisc crashes with limit of 2 packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 18 Sep 2007 19:57:14 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Chuck Ebbert <cebbert@...hat.com>
CC:	Netdev <netdev@...r.kernel.org>
Subject: Re: SFQ qdisc crashes with limit of 2 packets

Patrick McHardy wrote:
> Chuck Ebbert wrote:
> 
>>Limit of 1 is forbidden, crashes with 2, works with 3:
>>
>>>>From disassembling sch_sfq.ko it seems that it is on line 360 of sch_sfq.c:
>>    sch->qstats.backlog -= skb->len;
>>where "skb" is an invalid pointer:
> 
> 
> 
> Is it a NULL pointer or something random?

Never mind, I found the reason. When enqueuing the packet, sfq_enqueue
contains an off-by-one in the limit check (which IIRC is there for a
reason, but I can't remember right now) and drops the packet again.
dev_queue_xmit() calls qdisc_run() anyway and the empty qdisc is
dequeued, which is not handled by SFQ.

I see three possibilities to fix this (in my preferred order):

1) figure out why the off-by-one is there, if not needed remove
2) don't dequeue qdiscs even once if empty
3) check for NULL in sfq_dequeue

So I'll try to remeber why the off-by-one is there ..
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html