github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-29 10:41:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
1,353,403 Commits 1 Branch 940 Tags 24 GiB
C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%
ac9fe7dd8e
Go to file
Pedro Tammela ac9fe7dd8e net_sched: hfsc: Address reentrant enqueue adding class to eltree twice 
Savino says:
    "We are writing to report that this recent patch
    (141d34391a) [1]
    can be bypassed, and a UAF can still occur when HFSC is utilized with
    NETEM.

    The patch only checks the cl->cl_nactive field to determine whether
    it is the first insertion or not [2], but this field is only
    incremented by init_vf [3].

    By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the
    check and insert the class twice in the eltree.
    Under normal conditions, this would lead to an infinite loop in
    hfsc_dequeue for the reasons we already explained in this report [5].

    However, if TBF is added as root qdisc and it is configured with a
    very low rate,
    it can be utilized to prevent packets from being dequeued.
    This behavior can be exploited to perform subsequent insertions in the
    HFSC eltree and cause a UAF."

To fix both the UAF and the infinite loop, with netem as an hfsc child,
check explicitly in hfsc_enqueue whether the class is already in the eltree
whenever the HFSC_RSC flag is set.

[1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547
[2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572
[3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677
[4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574
[5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u

Fixes: 37d9cf1a3c ("sched: Fix detection of empty queues in child qdiscs")
Reported-by: Savino Dicanosa <savy@syst3mfailure.io>
Reported-by: William Liu <will@willsroot.io>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Link: https://patch.msgid.link/20250522181448.1439717-2-pctammela@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-05-28 08:55:35 +02:00
arch Misc x86 fixes: 2025-05-17 08:43:51 -07:00
block SCSI fixes on 20250516 2025-05-16 10:28:22 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: algif_hash - fix double free in hash_accept 2025-05-19 13:44:16 +08:00
Documentation This is somewhat larger than what I hoped for, with a few PRs from 2025-05-22 09:15:19 -07:00
drivers octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback 2025-05-28 08:47:10 +02:00
fs Hello Linus. 2025-05-20 09:03:34 -07:00
include vsock/virtio: fix rx_bytes accounting for stream sockets 2025-05-26 19:04:21 +02:00
init init: remove unused CONFIG_CC_CAN_LINK_STATIC 2025-05-12 15:03:46 +09:00
io_uring io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() 2025-05-14 07:15:28 -06:00
ipc treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
kernel This push fixes a regression in padata as well as an ancient 2025-05-20 20:10:01 -07:00
lib hardening fixes for v6.15-rc3 2025-04-18 13:20:20 -07:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm Nine singleton hotfixes, all MM. Four are cc:stable. 2025-05-17 10:56:52 -07:00
net net_sched: hfsc: Address reentrant enqueue adding class to eltree twice 2025-05-28 08:55:35 +02:00
rust rust: clean Rust 1.88.0's clippy::uninlined_format_args lint 2025-05-07 00:11:47 +02:00
samples tracing: samples: Initialize trace_array_printk() with the correct function 2025-05-12 13:07:22 -04:00
scripts kbuild: fix typos "module.builtin" to "modules.builtin" 2025-05-12 15:04:52 +09:00
security landlock: Improve bit operations in audit code 2025-05-12 11:38:53 +02:00
sound ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup 2025-05-20 16:09:06 +02:00
tools selftests/tc-testing: Add an HFSC qlen accounting test 2025-05-22 11:16:51 +02:00
usr usr/include: openrisc: don't HDRTEST bpf_perf_event.h 2025-05-12 15:03:17 +09:00
virt ARM: 2025-04-08 13:47:55 -07:00
.clang-format clang-format: Update the ForEachMacros list for v6.15-rc1 2025-04-13 11:03:59 +02:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: Retire Ralf Baechle 2024-11-12 15:48:59 +01:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore kbuild: Create intermediate vmlinux build with relocations preserved 2025-03-17 00:29:50 +09:00
.mailmap soc: fixes for 6.15, part 2 2025-05-14 09:11:05 -07:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: update SLAB ALLOCATOR maintainers 2025-04-17 20:10:06 -07:00
Kbuild drm: ensure drm headers are self-contained and pass kernel-doc 2025-02-12 10:44:43 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS This is somewhat larger than what I hoped for, with a few PRs from 2025-05-22 09:15:19 -07:00
Makefile Linux 6.15-rc7 2025-05-18 13:57:29 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.