mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

net/sched: netem: handle multi-segment skb in corruption

Browse Source 
The packet corruption code only flipped bits in the linear
header portion of the skb, skipping corruption when
skb_headlen() was zero.

Linearize the whole skb if necessary before corruption.
Extends d64cb81dcb ("net/sched: sch_netem: fix out-of-bounds access
in packet corruption") with a more general solution.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Link: https://patch.msgid.link/20260509171123.307549-5-stephen@networkplumber.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Stephen Hemminger
2026-05-09 10:03:25 -07:00
committed by Paolo Abeni
parent 675f6f1968
commit e8be7cdedc
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
net/sched/sch_netem.c
View File

@@ -513,16 +513,17 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
qdisc_qstats_drop(sch);
goto finish_segs;
}
if (skb->ip_summed == CHECKSUM_PARTIAL &&
skb_checksum_help(skb)) {
if (skb_linearize(skb) ||
(skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_help(skb))) {
qdisc_drop(skb, sch, to_free);
skb = NULL;
goto finish_segs;
}
if (skb_headlen(skb))
skb->data[get_random_u32_below(skb_headlen(skb))] ^=
1 << get_random_u32_below(8);
if (skb->len) {
u32 offset = get_random_u32_below(skb->len);
skb->data[offset] ^= 1 << get_random_u32_below(8);
}
}
if (unlikely(sch->q.qlen >= sch->limit)) {