Skip to content

Commit ac9fe7d

Browse files
tammelaPaolo Abeni
authored andcommitted
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
Savino says: "We are writing to report that this recent patch (141d343) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u Fixes: 37d9cf1 ("sched: Fix detection of empty queues in child qdiscs") Reported-by: Savino Dicanosa <[email protected]> Reported-by: William Liu <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Tested-by: Victor Nogueira <[email protected]> Signed-off-by: Pedro Tammela <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
1 parent 67af4ec commit ac9fe7d

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

net/sched/sch_hfsc.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,11 @@ struct hfsc_sched {
175175

176176
#define HT_INFINITY 0xffffffffffffffffULL /* infinite time value */
177177

178+
static bool cl_in_el_or_vttree(struct hfsc_class *cl)
179+
{
180+
return ((cl->cl_flags & HFSC_FSC) && cl->cl_nactive) ||
181+
((cl->cl_flags & HFSC_RSC) && !RB_EMPTY_NODE(&cl->el_node));
182+
}
178183

179184
/*
180185
* eligible tree holds backlogged classes being sorted by their eligible times.
@@ -1040,6 +1045,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
10401045
if (cl == NULL)
10411046
return -ENOBUFS;
10421047

1048+
RB_CLEAR_NODE(&cl->el_node);
1049+
10431050
err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
10441051
if (err) {
10451052
kfree(cl);
@@ -1572,7 +1579,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
15721579
sch->qstats.backlog += len;
15731580
sch->q.qlen++;
15741581

1575-
if (first && !cl->cl_nactive) {
1582+
if (first && !cl_in_el_or_vttree(cl)) {
15761583
if (cl->cl_flags & HFSC_RSC)
15771584
init_ed(cl, len);
15781585
if (cl->cl_flags & HFSC_FSC)

0 commit comments

Comments
 (0)