tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net_sched: Prevent creation of classes with TC_H_ROOT

Browse Source 
The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
condition when traversing up the qdisc tree to update parent backlog
counters. However, if a class is created with classid TC_H_ROOT, the
traversal terminates prematurely at this class instead of reaching the
actual root qdisc, causing parent statistics to be incorrectly maintained.
In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT
(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

Reported-by: Mingi Cho <mincho@theori.io>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 066a3b5b23 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop")
Link: https://patch.msgid.link/20250306232355.93864-2-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e)
CVE-2025-21971
Signed-off-by: Tim Whisonant <tim.whisonant@canonical.com>
Acked-by: Kuba Pawlak <kuba.pawlak@canonical.com>
Acked-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
This commit is contained in:
Cong Wang
2025-04-04 11:40:36 -07:00
committed by Mehmet Basaran
parent 886a445a7b
commit c259f3f4bd
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/sched/sch_api.c
+6
View File
@@ -2254,6 +2254,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
return -EOPNOTSUPP;
}
/* Prevent creation of traffic classes with classid TC_H_ROOT */
if (clid == TC_H_ROOT) {
NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT");
return -EINVAL;
}
new_cl = cl;
err = -EOPNOTSUPP;
if (cops->change)