Re: [PATCH net] net: netem: fix use after free and double free with packet corruption

2019-06-15 Thread Jakub Kicinski
On Fri, 14 Jun 2019 19:08:08 -0700 (PDT), David Miller wrote: > From: Jakub Kicinski > Date: Wed, 12 Jun 2019 11:51:21 -0700 > > > Brendan reports that the use of netem's packet corruption capability > > leads to strange crashes. This seems to be caused by > > commit d66280b12bd7 ("net: netem: u

Re: [PATCH net] net: netem: fix use after free and double free with packet corruption

2019-06-14 Thread David Miller
From: Jakub Kicinski Date: Wed, 12 Jun 2019 11:51:21 -0700 > Brendan reports that the use of netem's packet corruption capability > leads to strange crashes. This seems to be caused by > commit d66280b12bd7 ("net: netem: use a list in addition to rbtree") > which uses skb->next pointer to constr

Re: [PATCH net] net: netem: fix use after free and double free with packet corruption

2019-06-14 Thread Jakub Kicinski
On Fri, 14 Jun 2019 09:40:18 -0700, Cong Wang wrote: > On Wed, Jun 12, 2019 at 11:52 AM Jakub Kicinski wrote: > > > > Brendan reports that the use of netem's packet corruption capability > > leads to strange crashes. This seems to be caused by > > commit d66280b12bd7 ("net: netem: use a list in ad

Re: [PATCH net] net: netem: fix use after free and double free with packet corruption

2019-06-14 Thread Cong Wang
On Wed, Jun 12, 2019 at 11:52 AM Jakub Kicinski wrote: > > Brendan reports that the use of netem's packet corruption capability > leads to strange crashes. This seems to be caused by > commit d66280b12bd7 ("net: netem: use a list in addition to rbtree") > which uses skb->next pointer to construct

[PATCH net] net: netem: fix use after free and double free with packet corruption

2019-06-12 Thread Jakub Kicinski
Brendan reports that the use of netem's packet corruption capability leads to strange crashes. This seems to be caused by commit d66280b12bd7 ("net: netem: use a list in addition to rbtree") which uses skb->next pointer to construct a fast-path queue of in-order skbs. Packet corruption code has t