diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-12-22 20:39:59 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-12-22 20:39:59 +0100 |
| commit | ee09b3c1cff0335137dc1b146488e4352f640f13 (patch) | |
| tree | 4f21be5938205963ab73f8ca2ebdd0f4a65f8b17 /drivers/net/can/pch_can.c | |
| parent | Merge branch '20101221_static_const' of git://repo.or.cz/linux-2.6/trivial-mods (diff) | |
| download | linux-ee09b3c1cff0335137dc1b146488e4352f640f13.tar.xz linux-ee09b3c1cff0335137dc1b146488e4352f640f13.zip | |
sfq: fix sfq class stats handling
sfq_walk() runs without qdisc lock. By the time it selects a non empty
hash slot and sfq_dump_class_stats() is run (with lock held), slot might
have been freed : We then access q->slots[SFQ_EMPTY_SLOT], out of
bounds, and crash in slot_queue_walk()
On previous kernels, bug is here but out of bounds qs[SFQ_DEPTH] and
allot[SFQ_DEPTH] are located in struct sfq_sched_data, so no illegal
memory access happens, only possibly wrong data reported to user.
Also, slot_dequeue_tail() should make sure slot skb chain is correctly
terminated, or sfq_dump_class_stats() can access freed skbs.
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/can/pch_can.c')
0 files changed, 0 insertions, 0 deletions