Cong Wang 638ba50893 netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() ... qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops->qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses ->qlen_notify() to maintain its active list. Fixes: f8d4bc4550 ("net/sched: netem: account for backlog updates from child qdisc") Cc: Martin Ottens <martin.ottens@fau.de> Reported-by: Mingi Cho <mincho@theori.io> Signed-off-by: Cong Wang <cong.wang@bytedance.com> Link: https://patch.msgid.link/20250204005841.223511-4-xiyou.wangcong@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-02-05 18:14:46 -08:00
..
6lowpan	ipv6: eliminate ndisc_ops_is_useropt()	2024-08-12 17:23:57 -07:00
9p	net/9p/usbg: allow building as standalone module	2024-11-22 23:48:14 +09:00
802	net: 802: LLC+SNAP OID:PID lookup on start of skb data	2025-01-04 08:06:24 -08:00
8021q	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
appletalk	net: appletalk: Drop aarp_send_probe_phase1()	2025-01-20 10:08:19 +00:00
atm	atm: clean up a put_user() calls	2024-06-14 19:08:50 -07:00
ax25	ax25: rcu protect dev->ax25_ptr	2025-01-06 15:57:01 -08:00
batman-adv	This cleanup patchset includes the following patches:	2025-01-18 17:57:31 -08:00
bluetooth	First batch of fixes for 6.14. Nothing really stands out,	2025-01-30 12:24:20 -08:00
bpf	bpf-next-6.14	2025-01-23 08:04:07 -08:00
bridge	netfilter: br_netfilter: remove unused conditional and dead code	2025-01-19 16:41:52 +01:00
caif	caif: Remove unused cfsrvl_getphyid	2024-10-08 15:33:49 -07:00
can	sock: support SO_PRIORITY cmsg	2024-12-16 18:13:44 -08:00
ceph	ceph: allocate sparse_ext map only for sparse reads	2024-12-16 23:25:44 +01:00
core	net: harmonize tstats and dstats	2025-02-03 18:39:59 -08:00
dcb	dcb: Use rtnl_register_many().	2024-10-15 18:52:26 -07:00
dccp	sysctl net: Remove macro checks for CONFIG_SYSCTL	2025-01-20 12:01:34 -08:00
devlink	devlink: Improve the port attributes description	2025-01-02 17:10:57 -08:00
dns_resolver	Networking changes for 6.8.	2024-01-11 10:07:29 -08:00
dsa	Driver core and debugfs updates	2025-01-28 12:25:12 -08:00
ethernet	netkit: Fix pkt_type override upon netkit pass verdict	2024-05-25 10:48:57 -07:00
ethtool	ethtool: ntuple: fix rss + ring_cookie check	2025-02-03 18:38:58 -08:00
handshake	module: Convert symbol namespace to string literal	2024-12-02 11:34:44 -08:00
hsr	First batch of fixes for 6.14. Nothing really stands out,	2025-01-30 12:24:20 -08:00
ieee802154	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
ife	net: sched: ife: fix potential use-after-free	2023-12-15 10:50:18 +00:00
ipv4	udp: gso: do not drop small packets when PMTU reduces	2025-02-03 10:13:27 +00:00
ipv6	udp: gso: do not drop small packets when PMTU reduces	2025-02-03 10:13:27 +00:00
iucv	s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()	2024-11-26 10:02:53 +01:00
kcm	kcm: replace call_rcu by kfree_rcu for simple kmem_cache_free callback	2024-10-15 10:50:21 -07:00
key	xfrm: Add support for per cpu xfrm state handling.	2024-10-29 11:56:00 +01:00
l2tp	l2tp: Use inet_sk_init_flowi4() in l2tp_ip_sendmsg().	2024-12-20 13:50:09 -08:00
l3mdev
lapb
llc	sysctl net: Remove macro checks for CONFIG_SYSCTL	2025-01-20 12:01:34 -08:00
mac80211	Driver core and debugfs updates	2025-01-28 12:25:12 -08:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-01-09 16:11:47 -08:00
mctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-12-19 11:35:07 -08:00
mpls	rtnetlink: Return int from rtnl_af_register().	2024-10-22 11:02:05 +02:00
mptcp	mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted	2025-01-30 14:02:19 +01:00
ncsi	net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling	2025-01-27 09:20:07 +00:00
netfilter	First batch of fixes for 6.14. Nothing really stands out,	2025-01-30 12:24:20 -08:00
netlabel	net: corrections for security_secid_to_secctx returns	2025-01-04 22:11:22 -05:00
netlink	net: netlink: catch attempts to send empty messages	2024-12-19 18:06:28 -08:00
netrom	netrom: check buffer length before accessing it	2024-12-23 10:04:55 -08:00
nfc	NFC: nci: Add bounds checking in nci_hci_create_pipe()	2025-01-22 19:39:27 -08:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-04-26 12:20:01 +02:00
openvswitch	openvswitch: fix lockup on tx to unregistering netdev with carrier	2025-01-10 18:20:49 -08:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-01-03 16:29:29 -08:00
phonet	phonet: do not call synchronize_rcu() from phonet_route_del()	2024-11-07 20:34:16 -08:00
psample	psample: adjust size if rate_as_probability is set	2024-12-18 19:23:04 -08:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-09-24 10:48:16 +02:00
rds	rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy	2025-01-09 08:53:35 -08:00
rfkill	Get rid of 'remove_new' relic from platform driver struct	2024-12-01 15:12:43 -08:00
rose	net: rose: lock the socket in rose_bind()	2025-02-04 14:03:58 -08:00
rxrpc	rxrpc: Fix the rxrpc_connection attend queue handling	2025-02-04 15:30:28 +01:00
sched	netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()	2025-02-05 18:14:46 -08:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-01-09 16:11:47 -08:00
shaper	net: add netdev_lock() / netdev_unlock() helpers	2025-01-15 19:13:33 -08:00
smc	net/smc: fix data error when recvmsg with MSG_PEEK flag	2025-01-13 18:59:00 -08:00
strparser
sunrpc	NFS Client Updates for Linux 6.14	2025-01-28 14:23:46 -08:00
switchdev	net: bridge: switchdev: Improve error message for port_obj_add/del functions	2024-05-08 12:19:12 +01:00
tipc	tipc: re-order conditions in tipc_crypto_key_rcv()	2025-01-20 12:18:26 +00:00
tls	tls: skip setting sk_write_space on rekey	2025-01-10 18:34:45 -08:00
unix	af_unix: Use consume_skb() in connect() and sendmsg().	2025-01-20 11:27:42 -08:00
vmw_vsock	First batch of fixes for 6.14. Nothing really stands out,	2025-01-30 12:24:20 -08:00
wireless	Driver core and debugfs updates	2025-01-28 12:25:12 -08:00
x25	net: change proto and proto_ops accept type	2024-05-13 18:19:09 -06:00
xdp	xsk: Bring back busy polling support	2025-01-10 18:07:56 -08:00
xfrm	ipsec-2025-01-27	2025-01-27 15:15:12 -08:00
compat.c	file: stop exposing receive_fd_user()	2023-12-12 14:24:14 +01:00
devres.c
Kconfig	netlink: spec: add shaper YAML spec	2024-10-10 08:30:21 -07:00
Kconfig.debug	rtnetlink: Add per-netns RTNL.	2024-10-08 15:16:59 +02:00
Makefile	netlink: spec: add shaper YAML spec	2024-10-10 08:30:21 -07:00
socket.c	socket: Remove unused kernel_sendmsg_locked	2025-01-14 17:29:04 -08:00
sysctl_net.c	sysctl: Remove check for sentinel element in ctl_table arrays	2024-06-13 10:50:52 +02:00