netdev - Re: [PATCH] sched: QFQ - quick fair queue scheduler (v2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1299081212.2920.14.camel@edumazet-laptop>
Date:	Wed, 02 Mar 2011 16:53:32 +0100
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Stephen Hemminger <shemminger@...tta.com>
Cc:	David Miller <davem@...emloft.net>,
	Fabio Checconi <fabio@...dalf.sssup.it>,
	Luigi Rizzo <rizzo@....unipi.it>, netdev@...r.kernel.org
Subject: Re: [PATCH] sched: QFQ - quick fair queue scheduler (v2)

Le lundi 28 février 2011 à 17:17 -0800, Stephen Hemminger a écrit :
> This is an implementation of the Quick Fair Queue scheduler developed
> by Fabio Checconi. The same algorithm is already implemented in ipfw
> in FreeBSD. Fabio had an earlier version developed on Linux, I just
> cleaned it up and tested it. All bugs are mine.



Here is my crash analysis :

> +static void qfq_reset_qdisc(struct Qdisc *sch)
> +{
> +	struct qfq_sched *q = qdisc_priv(sch);
> +	struct qfq_group *grp;
> +	struct qfq_class *cl, **pp;
> +	struct hlist_node *n;
> +	unsigned int i, j;
> +
> +	for (i = 0; i <= QFQ_MAX_INDEX; i++) {
> +		grp = &q->groups[i];
> +		for (j = 0; j < QFQ_MAX_SLOTS; j++) {
> +			for (pp = &grp->slots[j]; *pp; pp = &(*pp)->next) {
> +				cl = *pp;
> +				if (cl->qdisc->q.qlen)
> +					qfq_deactivate_class(q, cl, pp);

Here, if we deactivated last class in chain, *pp is NULL, but

pp = &(*pp)->next  put 0x50 (on 64bit arches) in pp, so we crash ...





> +			}
> +		}
> +	}
> +
> +	for (i = 0; i < q->clhash.hashsize; i++) {
> +		hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode)
> +			qdisc_reset(cl->qdisc);
> +	}
> +	sch->q.qlen = 0;
> +}
> +



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html