michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
v6.14.11
linux/net
History
Pedro Tammela 4e38eaaabf net_sched: hfsc: Address reentrant enqueue adding class to eltree twice 
commit ac9fe7dd8e upstream.

Savino says:
    "We are writing to report that this recent patch
    (141d34391a) [1]
    can be bypassed, and a UAF can still occur when HFSC is utilized with
    NETEM.

    The patch only checks the cl->cl_nactive field to determine whether
    it is the first insertion or not [2], but this field is only
    incremented by init_vf [3].

    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the
    check and insert the class twice in the eltree.
    Under normal conditions, this would lead to an infinite loop in
    hfsc_dequeue for the reasons we already explained in this report [5].

    However, if TBF is added as root qdisc and it is configured with a
    very low rate,
    it can be utilized to prevent packets from being dequeued.
    This behavior can be exploited to perform subsequent insertions in the
    HFSC eltree and cause a UAF."

To fix both the UAF and the infinite loop, with netem as an hfsc child,
check explicitly in hfsc_enqueue whether the class is already in the eltree
whenever the HFSC_RSC flag is set.

[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547
[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572
[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677
[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574
[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u

Fixes: 37d9cf1a3c ("sched: Fix detection of empty queues in child qdiscs")
Reported-by: Savino Dicanosa <savy@syst3mfailure.io>
Reported-by: William Liu <will@willsroot.io>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Link: https://patch.msgid.link/20250522181448.1439717-2-pctammela@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-04 14:45:08 +02:00
..
6lowpan
ipv6: eliminate ndisc_ops_is_useropt()
2024-08-12 17:23:57 -07:00
9p
9p/trans_fd: mark concurrent read and writes to p9_conn->err
2025-05-02 08:02:04 +02:00
802
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-01-04 08:06:24 -08:00
8021q
net: vlan: don't propagate flags on open
2025-04-20 10:22:35 +02:00
appletalk
net: appletalk: Drop aarp_send_probe_phase1()
2025-01-20 10:08:19 +00:00
atm
atm: Fix NULL pointer dereference
2025-04-07 10:11:11 +02:00
ax25
ax25: Remove broken autobind
2025-04-10 14:44:12 +02:00
batman-adv
Merge tag 'batadv-net-pullrequest-20250318' of git://git.open-mesh.org/linux-merge
2025-03-20 15:30:00 +01:00
bluetooth
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
2025-05-29 11:13:57 +02:00
bpf
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
2025-01-29 08:51:51 -08:00
bridge
bridge: netfilter: Fix forwarding of fragmented packets
2025-05-29 11:13:57 +02:00
caif
caif: Remove unused cfsrvl_getphyid
2024-10-08 15:33:49 -07:00
can
can: bcm: add missing rcu read protection for procfs content
2025-05-29 11:14:01 +02:00
ceph
ceph: allocate sparse_ext map only for sparse reads
2024-12-16 23:25:44 +01:00
core
net-sysfs: restore behavior for not running devices
2025-05-29 11:13:50 +02:00
dcb
dcb: Use rtnl_register_many().
2024-10-15 18:52:26 -07:00
dccp
sysctl net: Remove macro checks for CONFIG_SYSCTL
2025-01-20 12:01:34 -08:00
devlink
devlink: fix xa_alloc_cyclic() error handling
2025-03-19 09:57:36 +00:00
dns_resolver
…
dsa
net: dsa: microchip: linearize skb for tail-tagging switches
2025-05-29 11:14:02 +02:00
ethernet
netkit: Fix pkt_type override upon netkit pass verdict
2024-05-25 10:48:57 -07:00
ethtool
ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll()
2025-04-25 10:50:52 +02:00
handshake
module: Convert symbol namespace to string literal
2024-12-02 11:34:44 -08:00
hsr
net: hsr: Fix PRP duplicate detection
2025-05-29 11:12:44 +02:00
ieee802154
net: convert to nla_get_*_default()
2024-11-11 10:32:06 -08:00
ife
…
ipv4
mr: consolidate the ipmr_can_free_table() checks.
2025-05-29 11:13:58 +02:00
ipv6
mr: consolidate the ipmr_can_free_table() checks.
2025-05-29 11:13:58 +02:00
iucv
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
2024-11-26 10:02:53 +01:00
kcm
kcm: replace call_rcu by kfree_rcu for simple kmem_cache_free callback
2024-10-15 10:50:21 -07:00
key
xfrm: Add support for per cpu xfrm state handling.
2024-10-29 11:56:00 +01:00
l2tp
l2tp: Use inet_sk_init_flowi4() in l2tp_ip_sendmsg().
2024-12-20 13:50:09 -08:00
l3mdev
…
lapb
…
llc
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-05-29 11:14:02 +02:00
mac80211
wifi: mac80211: restore monitor for outgoing frames
2025-05-29 11:14:06 +02:00
mac802154
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-01-09 16:11:47 -08:00
mctp
net: mctp: Ensure keys maintain only one ref to corresponding dev
2025-05-22 14:31:43 +02:00
mpls
rtnetlink: Return int from rtnl_af_register().
2024-10-22 11:02:05 +02:00
mptcp
mptcp: pm: userspace: flags: clearer msg if no remote addr
2025-05-29 11:13:31 +02:00
ncsi
net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling
2025-01-27 09:20:07 +00:00
netfilter
netfilter: conntrack: Bound nf_conntrack sysctl writes
2025-05-29 11:12:45 +02:00
netlabel
net: corrections for security_secid_to_secctx returns
2025-01-04 22:11:22 -05:00
netlink
net: better track kernel sockets lifetime
2025-02-21 16:00:58 -08:00
netrom
netrom: check buffer length before accessing it
2024-12-23 10:04:55 -08:00
nfc
NFC: nci: Add bounds checking in nci_hci_create_pipe()
2025-01-22 19:39:27 -08:00
nsh
nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
2024-04-26 12:20:01 +02:00
openvswitch
openvswitch: Fix unsafe attribute parsing in output_userspace()
2025-05-18 08:25:56 +02:00
packet
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-01-03 16:29:29 -08:00
phonet
phonet: do not call synchronize_rcu() from phonet_route_del()
2024-11-07 20:34:16 -08:00
psample
psample: adjust size if rate_as_probability is set
2024-12-18 19:23:04 -08:00
qrtr
net: qrtr: Update packets cloning when broadcasting
2024-09-24 10:48:16 +02:00
rds
net: better track kernel sockets lifetime
2025-02-21 16:00:58 -08:00
rfkill
Get rid of 'remove_new' relic from platform driver struct
2024-12-01 15:12:43 -08:00
rose
net: rose: lock the socket in rose_bind()
2025-02-04 14:03:58 -08:00
rxrpc
rxrpc: Fix locking issues with the peer record hash
2025-02-21 15:06:29 -08:00
sched
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
2025-06-04 14:45:08 +02:00
sctp
sctp: detect and prevent references to a freed transport in sendmsg
2025-04-20 10:23:09 +02:00
shaper
net: add netdev_lock() / netdev_unlock() helpers
2025-01-15 19:13:33 -08:00
smc
net/smc: use the correct ndev to find pnetid by pnetid table
2025-05-29 11:12:42 +02:00
strparser
strparser: Add read_sock callback
2025-01-29 13:32:08 -08:00
sunrpc
SUNRPC: rpcbind should never reset the port to the value '0'
2025-05-29 11:12:27 +02:00
switchdev
net: switchdev: Convert blocking notification chain to a raw one
2025-03-11 11:30:28 +01:00
tipc
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
2025-05-29 11:14:00 +02:00
tls
net/tls: fix kernel panic when alloc_page failed
2025-05-22 14:31:46 +02:00
unix
af_unix: Fix memory leak in unix_dgram_sendmsg()
2025-02-26 19:01:36 -08:00
vmw_vsock
vsock: avoid timeout during connect() if the socket is closing
2025-04-10 14:44:41 +02:00
wireless
wifi: cfg80211: allow IR in 20 MHz configurations
2025-05-29 11:12:48 +02:00
x25
net: change proto and proto_ops accept type
2024-05-13 18:19:09 -06:00
xdp
xsk: Bring back busy polling support in XDP_COPY
2025-05-29 11:13:59 +02:00
xfrm
xfrm: Sanitize marks before insert
2025-05-29 11:13:56 +02:00
compat.c
…
devres.c
…
Kconfig
netlink: spec: add shaper YAML spec
2024-10-10 08:30:21 -07:00
Kconfig.debug
rtnetlink: Add per-netns RTNL.
2024-10-08 15:16:59 +02:00
Makefile
netlink: spec: add shaper YAML spec
2024-10-10 08:30:21 -07:00
socket.c
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
2025-04-10 14:44:12 +02:00
sysctl_net.c
sysctl: Remove check for sentinel element in ctl_table arrays
2024-06-13 10:50:52 +02:00