github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-06 18:46:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
7addb4e5ef
linux/net
History
Kuniyuki Iwashima dff39930ad net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 
If a netlink socket sends RTM_GETCHAIN requests repeatedly
without recv()ing the responses, tc_ctl_chain() hogs CPU and
triggers Hung Task splat. [0]

As caught in the stack trace, netlink_attachskb() could confuse
tc_ctl_chain() by returning -EAGAIN when the userspace netlink
socket's receive buffer is full.

The replay: label exists since commit 32a4f5ecd7 ("net: sched:
introduce chain object to uapi") but was not used initially.

Since commit 9f407f1768 ("net: sched: introduce chain templates"),
the label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()
may release RTNL to call request_module().

However, the replay logic is unnecessary for RTM_GETCHAIN.

Let's apply the replay logic only for RTM_NEWCHAIN.

[0]:
INFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.
task:repro           state:R  running task     stack:14096 pid:1022  tgid:1014  ppid:961    task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 ? clockevents_program_event (kernel/time/clockevents.c:372)
 ? pskb_expand_head (net/core/skbuff.c:615)
 ? skb_release_data (net/core/skbuff.c:1122)
 ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232)
 ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499)
 ? tc_chain_notify (net/sched/cls_api.c:3045)
 ? tc_chain_notify (./include/linux/skbuff.h:1384 net/sched/cls_api.c:3041)
 ? netlink_unicast (net/netlink/af_netlink.c:1335)
 ? rtnl_unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985)
 ? tc_ctl_chain (net/sched/cls_api.c:3242)
 ? rtnetlink_rcv_msg (net/core/rtnetlink.c:7146)
 ? netlink_unicast (net/netlink/af_netlink.c:1354)
 ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:7177)
 ? netlink_rcv_skb (net/netlink/af_netlink.c:2556)
 ? netlink_unicast (net/netlink/af_netlink.c:1319)
 ? netlink_sendmsg (net/netlink/af_netlink.c:1900)
 ? __sock_sendmsg (net/socket.c:800)
 ? __sys_sendto (net/socket.c:2281)
 ? __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
 ? do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
 ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
 </TASK>

Fixes: 2ed9db3074 ("net: sched: cls_api: fix dead code in switch")
Reported-by: Taras Madan <tarasmadan@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: hybris@mojatatu.ai
Link: https://patch.msgid.link/20260908205537.863484-1-kuniyu@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-10 12:06:23 +02:00
..
6lowpan net: 6lowpan: fix mismatched comments 2026-09-02 09:03:06 +02:00
9p 9p: Add missing read barrier in virtio zero-copy path 2026-06-21 05:22:57 +00:00
802 appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
8021q vlan: fix skb_under_panic and races when toggling HW VLAN offload 2026-08-20 13:05:43 -07:00
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-06 11:53:47 -07:00
batman-adv Here are a few batman-adv bugfixes: 2026-08-22 12:42:58 -07:00
bluetooth Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() 2026-09-08 17:12:45 -04:00
bpf bpf: Fix partial copy of non-linear test_run output 2026-06-21 17:55:06 -07:00
bridge net: bridge: use option bits for CFM/MRP frame handlers 2026-09-08 17:48:49 -07:00
can can: isotp: check register_netdevice_notifier() error in module init 2026-07-29 11:26:41 +02:00
ceph A wide variety of mostly CephFS fixes and cleanups, split between 2026-08-28 11:51:05 -07:00
core net: reject oversized tx_queue_len at netlink parse time 2026-09-04 16:30:49 -07:00
dcb
devlink devlink: add generic device max_sfs parameter 2026-08-11 18:06:30 -07:00
dns_resolver keys, dns: Drop unused NUL terminator from upayload->data 2026-08-10 16:20:42 -07:00
dsa net: dsa: tag_brcm: legacy FCS: request needed tailroom 2026-09-09 13:31:08 -07:00
ethernet
ethtool ethtool: tsconfig: reject zero-valued tx_type and rx_filter bitsets 2026-08-13 17:44:54 -07:00
handshake
hsr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-08-18 10:42:41 -07:00
ieee802154 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink 2026-09-02 09:54:27 +02:00
ife net/sched: act_ife: Only operate on Ethernet frames 2026-08-24 11:59:59 -07:00
ipv4 inet: frags: invalidate queues before flushing them 2026-09-09 17:43:03 -07:00
ipv6 ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() 2026-09-08 17:08:33 -07:00
iucv net/iucv: fix the recvmsg window update 2026-08-31 15:51:22 -07:00
kcm net: kcm: Hold RCU read lock while running BPF parser 2026-08-17 13:43:58 -07:00
key ipsec-2026-06-22 2026-06-23 16:22:24 -07:00
l2tp net: l2tp: do not propagate multicast notification errors 2026-08-24 11:43:28 -07:00
l3mdev
lapb
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-17 13:17:46 +02:00
mac80211 Networking changes for 7.3. 2026-08-20 08:16:04 -07:00
mac802154 mac802154: fix use-after-free of sdata via queued RX frames 2026-09-03 11:00:54 +02:00
mctp net: mctp: hold a reference to the route device in mctp_route_lookup() 2026-08-20 12:27:40 -07:00
mpls Summary 2026-08-20 08:46:41 -07:00
mptcp mptcp: avoid pruning for OoW data 2026-09-09 13:32:56 -07:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-05 17:24:57 -07:00
netfilter netfilter: report NLM_F_DUMP_FILTERED when all is filtered out 2026-09-07 18:48:56 +02:00
netlabel
netlink genetlink: pin family module during policy dump 2026-09-03 17:21:35 -07:00
nfc nfc: nci: free destination parameters when closing a connection 2026-08-11 18:10:04 +02:00
nsh
openvswitch net: openvswitch: fix use-after-free of the flow table mask array 2026-09-08 17:24:10 -07:00
packet af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). 2026-09-01 10:42:56 +02:00
phonet phonet: pep: convert getsockopt to sockopt_t 2026-08-03 16:55:23 -07:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-06-17 16:35:50 -07:00
psp psp: use unrcu_pointer() for the cmpxchg() on netdev psp_dev 2026-08-17 11:06:14 -07:00
qrtr net: qrtr: Send HELLO message on endpoint register 2026-09-02 12:14:32 +01:00
rds net/rds: don't let rds_conn_shutdown() consume a concurrent drop 2026-09-02 19:42:24 -07:00
rfkill Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rxrpc rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() 2026-07-21 11:52:29 +02:00
sched net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 2026-09-10 12:06:23 +02:00
sctp sctp: validate chunk length in the inqueue parser 2026-08-30 14:17:53 -07:00
shaper
smc Including fixes from Bluetooth, IPSec and Netfilter. 2026-08-27 13:53:43 -07:00
strparser
sunrpc NFS client updates for Linux 7.3 2026-08-26 15:09:21 -07:00
switchdev
tipc tipc: Dont send random pad bytes in RESET/ACTIVATE messages 2026-08-31 20:02:36 -07:00
tls tls: device: fix out-of-bounds write in tls_append_frag() 2026-08-25 10:04:02 +02:00
unix af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. 2026-09-07 16:58:42 -07:00
vmw_vsock vsock/vmci: validate packet source for connected sockets 2026-08-31 16:50:54 -07:00
wireless Quite a bunch more work, of note: 2026-08-06 12:39:11 -07:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-07-30 18:46:45 -07:00
xdp xsk: honor XDP_TX_METADATA in zero-copy path 2026-08-24 11:12:00 -07:00
xfrm ipsec-2026-08-18 2026-08-20 11:38:14 -07:00
compat.c net: af_unix: useful handling of LSM denials on SCM_RIGHTS 2026-08-17 18:14:52 -07:00
devres.c
Kconfig appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
Kconfig.debug
Makefile appletalk: move the protocol out of tree 2026-06-16 14:37:06 -07:00
socket.c Major changes: 2026-08-20 07:36:20 -07:00
sysctl_net.c net: enforce net sysctl registration 2026-08-13 13:12:21 +02:00