From 112decb2cf111f1943e1344da4f63a0f1321862a Mon Sep 17 00:00:00 2001 From: Anmol Jain Date: Mon, 9 Jun 2025 22:36:44 +0000 Subject: [PATCH] net: sched: Fix use after free in red_enqueue() jira VULN-66497 cve CVE-2022-49921 commit-author Dan Carpenter commit 8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9 We can't use "skb" again after passing it to qdisc_enqueue(). This is basically identical to commit 2f09707d0c97 ("sch_sfb: Also store skb len before calling child enqueue"). Fixes: d7f4f332f082 ("sch_red: update backlog as well") Signed-off-by: Dan Carpenter Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller (cherry picked from commit 8bdc2acd420c6f3dd1f1c78750ec989f02a1e2b9) Signed-off-by: Anmol Jain --- net/sched/sch_red.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c index 2a8477dc3e01e..2f89d5f43a6f4 100644 --- a/net/sched/sch_red.c +++ b/net/sched/sch_red.c @@ -76,6 +76,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch, { struct red_sched_data *q = qdisc_priv(sch); struct Qdisc *child = q->qdisc; + unsigned int len; int ret; q->vars.qavg = red_calc_qavg(&q->parms, @@ -130,9 +131,10 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch, break; } + len = qdisc_pkt_len(skb); ret = qdisc_enqueue(skb, child, to_free); if (likely(ret == NET_XMIT_SUCCESS)) { - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog += len; sch->q.qlen++; } else if (net_xmit_drop_count(ret)) { q->stats.pdrop++;