Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net/sched
History
Stephen Hemminger d9b8ef816e sch/netem: fix use after free in netem_dequeue 
commit 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a upstream.

If netem_dequeue() enqueues packet to inner qdisc and that qdisc
returns __NET_XMIT_STOLEN. The packet is dropped but
qdisc_tree_reduce_backlog() is not called to update the parent's
q.qlen, leading to the similar use-after-free as Commit
e04991a48dbaf382 ("netem: fix return value if duplicate enqueue
fails")

Commands to trigger KASAN UaF:

ip link add type dummy
ip link set lo up
ip link set dummy0 up
tc qdisc add dev lo parent root handle 1: drr
tc filter add dev lo parent 1: basic classid 1:1
tc class add dev lo classid 1:1 drr
tc qdisc add dev lo parent 1:1 handle 2: netem
tc qdisc add dev lo parent 2: handle 3: drr
tc filter add dev lo parent 3: basic classid 3:1 action mirred egress
redirect dev dummy0
tc class add dev lo classid 3:1 drr
ping -c1 -W0.01 localhost # Trigger bug
tc class del dev lo classid 1:1
tc class add dev lo classid 1:1 drr
ping -c1 -W0.01 localhost # UaF

Fixes: 50612537e9ab ("netem: fix classful handling")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Link: https://patch.msgid.link/20240901182438.4992-1-stephen@networkplumber.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-19 14:51:17 +01:00
..
act_api.c net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() 2024-11-19 14:19:08 +01:00
act_bpf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_connmark.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_csum.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_ct.c sched: act_ct: take care of padding in struct zones_ht_key 2024-11-23 23:20:20 +01:00
act_ctinfo.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_gact.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_gate.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_ife.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_ipt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_meta_mark.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_meta_skbprio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_meta_skbtcindex.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_mirred.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_mpls.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_nat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_pedit.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_police.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_sample.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_simple.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_skbedit.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_skbmod.c net/sched: act_skbmod: prevent kernel-infoleak 2024-11-19 09:22:46 +01:00
act_tunnel_key.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
act_vlan.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_api.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_basic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_bpf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_cgroup.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_flow.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_flower.c net: sched: fix erspan_opt settings in cls_flower 2024-12-17 13:24:26 +01:00
cls_fw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_matchall.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_route.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cls_u32.c net: sched: cls_u32: Fix allocation size in u32_init() 2024-11-18 10:58:46 +01:00
em_canid.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_cmp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_ipset.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_ipt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_meta.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_nbyte.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
em_text.c net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-11-18 12:12:06 +01:00
em_u32.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ematch.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_api.c Revert "net/sched: accept TCA_STAB only for root qdisc" 2024-11-24 00:22:56 +01:00
sch_atm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_blackhole.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_cake.c net: sched: fix ordering of qlen adjustment 2025-01-15 16:29:40 +01:00
sch_cbq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_cbs.c net/sched: cbs: Fix integer overflow in cbs_set_port_rate() 2024-12-17 13:24:30 +01:00
sch_choke.c net: sched: fix ordering of qlen adjustment 2025-01-15 16:29:40 +01:00
sch_codel.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_drr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_dsmark.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_etf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_ets.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_fifo.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_fq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_fq_codel.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_fq_pie.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_generic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_gred.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_hfsc.c net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve 2024-11-08 11:26:11 +01:00
sch_hhf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_htb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_ingress.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_mq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_mqprio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_multiq.c net: sched: sch_multiq: fix possible OOB write in multiq_tune() 2024-11-19 14:19:00 +01:00
sch_netem.c sch/netem: fix use after free in netem_dequeue 2025-01-19 14:51:17 +01:00
sch_pie.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_plug.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_prio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_qfq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_red.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_sfb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_sfq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_skbprio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sch_taprio.c Revert "net: sched: consistently use rcu_replace_pointer() in taprio_change()" 2024-11-24 00:23:10 +01:00
sch_tbf.c net/sched: tbf: correct backlog statistic for GSO packets 2024-12-17 13:24:26 +01:00
sch_teql.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00