Hi! Corrupting GSO frames currently leads to crashes, due to skb use after free. These stem from the skb list handling - the segmented skbs come back on a list, and this list is not properly unlinked before enqueuing the segments. Turns out this condition is made very likely to occur because of another bug - in backlog accounting. Segments are counted twice, which means qdisc's limit gets reached leading to drops and making the use after free very likely to happen.
The bugs are fixed in order in which they were added to the tree. Jakub Kicinski (2): net: netem: fix backlog accounting for corrupted GSO frames net: netem: fix use after free and double free with packet corruption net/sched/sch_netem.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) -- 2.21.0
