From: Eric Dumazet Date: Wed, 22 Dec 2010 19:39:59 +0000 (-0800) Subject: sfq: fix sfq class stats handling X-Git-Tag: v2.6.38-rc1~476^2~107 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ee09b3c1cff0335137dc1b146488e4352f640f13;p=pandora-kernel.git sfq: fix sfq class stats handling sfq_walk() runs without qdisc lock. By the time it selects a non empty hash slot and sfq_dump_class_stats() is run (with lock held), slot might have been freed : We then access q->slots[SFQ_EMPTY_SLOT], out of bounds, and crash in slot_queue_walk() On previous kernels, bug is here but out of bounds qs[SFQ_DEPTH] and allot[SFQ_DEPTH] are located in struct sfq_sched_data, so no illegal memory access happens, only possibly wrong data reported to user. Also, slot_dequeue_tail() should make sure slot skb chain is correctly terminated, or sfq_dump_class_stats() can access freed skbs. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller --- Reading git-diff-tree failed