[PATCH net] net: netem: fix use after free and double free with packet corruption

[Jakub Kicinski]

Brendan reports that the use of netem's packet corruption capability
leads to strange crashes.  This seems to be caused by
commit d66280b12bd7 ("net: netem: use a list in addition to rbtree")
which uses skb->next pointer to construct a fast-path queue of
in-order skbs.

Packet corruption code has to invoke skb_gso_segment() in case
of skbs in need of GSO.  skb_gso_segment() returns a list of
skbs.  If next pointers of the skbs on that list do not get cleared
fast path list goes into the weeds and tries to access the next
segment skb multiple times.

Reported-by: Brendan Galloway <brendan.gallo...@netronome.com>
Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
Signed-off-by: Jakub Kicinski <jakub.kicin...@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vanderme...@netronome.com>
---
 net/sched/sch_netem.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 956ff3da81f4..1fd4405611e5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -494,16 +494,13 @@ static int netem_enqueue(struct sk_buff *skb, struct 
Qdisc *sch,
         */
        if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                if (skb_is_gso(skb)) {
-                       segs = netem_segment(skb, sch, to_free);
-                       if (!segs)
+                       skb = netem_segment(skb, sch, to_free);
+                       if (!skb)
                                return rc_drop;
-               } else {
-                       segs = skb;
+                       segs = skb->next;
+                       skb_mark_not_on_list(skb);
                }
 
-               skb = segs;
-               segs = segs->next;
-
                skb = skb_unshare(skb, GFP_ATOMIC);
                if (unlikely(!skb)) {
                        qdisc_qstats_drop(sch);
-- 
2.21.0