valis 8fc134fee2 net: sched: sch_qfq: Fix UAF in qfq_dequeue() ... When the plug qdisc is used as a class of the qfq qdisc it could trigger a UAF. This issue can be reproduced with following commands: tc qdisc add dev lo root handle 1: qfq tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512 tc qdisc add dev lo parent 1:1 handle 2: plug tc filter add dev lo parent 1: basic classid 1:1 ping -c1 127.0.0.1 and boom: [ 285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0 [ 285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144 [ 285.355903] [ 285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4 [ 285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 285.358376] Call Trace: [ 285.358773] <IRQ> [ 285.359109] dump_stack_lvl+0x44/0x60 [ 285.359708] print_address_description.constprop.0+0x2c/0x3c0 [ 285.360611] kasan_report+0x10c/0x120 [ 285.361195] ? qfq_dequeue+0xa7/0x7f0 [ 285.361780] qfq_dequeue+0xa7/0x7f0 [ 285.362342] __qdisc_run+0xf1/0x970 [ 285.362903] net_tx_action+0x28e/0x460 [ 285.363502] __do_softirq+0x11b/0x3de [ 285.364097] do_softirq.part.0+0x72/0x90 [ 285.364721] </IRQ> [ 285.365072] <TASK> [ 285.365422] __local_bh_enable_ip+0x77/0x90 [ 285.366079] __dev_queue_xmit+0x95f/0x1550 [ 285.366732] ? __pfx_csum_and_copy_from_iter+0x10/0x10 [ 285.367526] ? __pfx___dev_queue_xmit+0x10/0x10 [ 285.368259] ? __build_skb_around+0x129/0x190 [ 285.368960] ? ip_generic_getfrag+0x12c/0x170 [ 285.369653] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 285.370390] ? csum_partial+0x8/0x20 [ 285.370961] ? raw_getfrag+0xe5/0x140 [ 285.371559] ip_finish_output2+0x539/0xa40 [ 285.372222] ? __pfx_ip_finish_output2+0x10/0x10 [ 285.372954] ip_output+0x113/0x1e0 [ 285.373512] ? __pfx_ip_output+0x10/0x10 [ 285.374130] ? icmp_out_count+0x49/0x60 [ 285.374739] ? __pfx_ip_finish_output+0x10/0x10 [ 285.375457] ip_push_pending_frames+0xf3/0x100 [ 285.376173] raw_sendmsg+0xef5/0x12d0 [ 285.376760] ? do_syscall_64+0x40/0x90 [ 285.377359] ? __static_call_text_end+0x136578/0x136578 [ 285.378173] ? do_syscall_64+0x40/0x90 [ 285.378772] ? kasan_enable_current+0x11/0x20 [ 285.379469] ? __pfx_raw_sendmsg+0x10/0x10 [ 285.380137] ? __sock_create+0x13e/0x270 [ 285.380673] ? __sys_socket+0xf3/0x180 [ 285.381174] ? __x64_sys_socket+0x3d/0x50 [ 285.381725] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 285.382425] ? __rcu_read_unlock+0x48/0x70 [ 285.382975] ? ip4_datagram_release_cb+0xd8/0x380 [ 285.383608] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 285.384295] ? preempt_count_sub+0x14/0xc0 [ 285.384844] ? __list_del_entry_valid+0x76/0x140 [ 285.385467] ? _raw_spin_lock_bh+0x87/0xe0 [ 285.386014] ? __pfx__raw_spin_lock_bh+0x10/0x10 [ 285.386645] ? release_sock+0xa0/0xd0 [ 285.387148] ? preempt_count_sub+0x14/0xc0 [ 285.387712] ? freeze_secondary_cpus+0x348/0x3c0 [ 285.388341] ? aa_sk_perm+0x177/0x390 [ 285.388856] ? __pfx_aa_sk_perm+0x10/0x10 [ 285.389441] ? check_stack_object+0x22/0x70 [ 285.390032] ? inet_send_prepare+0x2f/0x120 [ 285.390603] ? __pfx_inet_sendmsg+0x10/0x10 [ 285.391172] sock_sendmsg+0xcc/0xe0 [ 285.391667] __sys_sendto+0x190/0x230 [ 285.392168] ? __pfx___sys_sendto+0x10/0x10 [ 285.392727] ? kvm_clock_get_cycles+0x14/0x30 [ 285.393328] ? set_normalized_timespec64+0x57/0x70 [ 285.393980] ? _raw_spin_unlock_irq+0x1b/0x40 [ 285.394578] ? __x64_sys_clock_gettime+0x11c/0x160 [ 285.395225] ? __pfx___x64_sys_clock_gettime+0x10/0x10 [ 285.395908] ? _copy_to_user+0x3e/0x60 [ 285.396432] ? exit_to_user_mode_prepare+0x1a/0x120 [ 285.397086] ? syscall_exit_to_user_mode+0x22/0x50 [ 285.397734] ? do_syscall_64+0x71/0x90 [ 285.398258] __x64_sys_sendto+0x74/0x90 [ 285.398786] do_syscall_64+0x64/0x90 [ 285.399273] ? exit_to_user_mode_prepare+0x1a/0x120 [ 285.399949] ? syscall_exit_to_user_mode+0x22/0x50 [ 285.400605] ? do_syscall_64+0x71/0x90 [ 285.401124] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 285.401807] RIP: 0033:0x495726 [ 285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09 [ 285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726 [ 285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000 [ 285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c [ 285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634 [ 285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000 [ 285.410403] </TASK> [ 285.410704] [ 285.410929] Allocated by task 144: [ 285.411402] kasan_save_stack+0x1e/0x40 [ 285.411926] kasan_set_track+0x21/0x30 [ 285.412442] __kasan_slab_alloc+0x55/0x70 [ 285.412973] kmem_cache_alloc_node+0x187/0x3d0 [ 285.413567] __alloc_skb+0x1b4/0x230 [ 285.414060] __ip_append_data+0x17f7/0x1b60 [ 285.414633] ip_append_data+0x97/0xf0 [ 285.415144] raw_sendmsg+0x5a8/0x12d0 [ 285.415640] sock_sendmsg+0xcc/0xe0 [ 285.416117] __sys_sendto+0x190/0x230 [ 285.416626] __x64_sys_sendto+0x74/0x90 [ 285.417145] do_syscall_64+0x64/0x90 [ 285.417624] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 285.418306] [ 285.418531] Freed by task 144: [ 285.418960] kasan_save_stack+0x1e/0x40 [ 285.419469] kasan_set_track+0x21/0x30 [ 285.419988] kasan_save_free_info+0x27/0x40 [ 285.420556] ____kasan_slab_free+0x109/0x1a0 [ 285.421146] kmem_cache_free+0x1c2/0x450 [ 285.421680] __netif_receive_skb_core+0x2ce/0x1870 [ 285.422333] __netif_receive_skb_one_core+0x97/0x140 [ 285.423003] process_backlog+0x100/0x2f0 [ 285.423537] __napi_poll+0x5c/0x2d0 [ 285.424023] net_rx_action+0x2be/0x560 [ 285.424510] __do_softirq+0x11b/0x3de [ 285.425034] [ 285.425254] The buggy address belongs to the object at ffff8880bad31280 [ 285.425254] which belongs to the cache skbuff_head_cache of size 224 [ 285.426993] The buggy address is located 40 bytes inside of [ 285.426993] freed 224-byte region [ffff8880bad31280, ffff8880bad31360) [ 285.428572] [ 285.428798] The buggy address belongs to the physical page: [ 285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31 [ 285.430758] flags: 0x100000000000200(slab|node=0|zone=1) [ 285.431447] page_type: 0xffffffff() [ 285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000 [ 285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 285.433562] page dumped because: kasan: bad access detected [ 285.434144] [ 285.434320] Memory state around the buggy address: [ 285.434828] ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 285.435580] ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 285.436777] ^ [ 285.437106] ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 285.437616] ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 285.438126] ================================================================== [ 285.438662] Disabling lock debugging due to kernel taint Fix this by: 1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a function compatible with non-work-conserving qdiscs 2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq. Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: valis <sec@valis.email> Signed-off-by: valis <sec@valis.email> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2023-09-05 08:54:12 +02:00
..
act_api.c	net: sched: Replace strlcpy with strscpy	2023-07-10 08:23:53 +01:00
act_bpf.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
act_connmark.c	net/sched: act_connmark: handle errno on tcf_idr_check_alloc	2023-03-01 08:19:09 +00:00
act_csum.c	net: skbuff: hide csum_not_inet when CONFIG_IP_SCTP not set	2023-04-19 13:04:30 +01:00
act_ct.c	net: sched: set IPS_CONFIRMED in tmpl status only when commit is set in act_ct	2023-07-20 10:06:36 +02:00
act_ctinfo.c	net/sched: act_ctinfo: use percpu stats	2023-02-13 20:09:01 -08:00
act_gact.c	Networking changes for 6.2.	2022-12-13 15:47:48 -08:00
act_gate.c	net/sched: act_gate: use percpu stats	2023-02-16 10:39:28 +01:00
act_ife.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
act_ipt.c	net/sched: act_ipt: zero skb->cb before calling target	2023-06-29 12:10:37 +02:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: Add carrier check	2023-05-01 07:26:10 +01:00
act_mpls.c	net/sched: remove two skb_mac_header() uses	2023-03-22 22:43:23 -07:00
act_nat.c	net/sched: act_nat: transition to percpu stats and rcu	2023-02-16 10:39:28 +01:00
act_pedit.c	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX	2023-07-04 10:31:38 +02:00
act_police.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
act_sample.c	net/sched: act_sample: fix action bind logic	2023-02-26 18:27:45 +00:00
act_simple.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
act_skbedit.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
act_skbmod.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
act_tunnel_key.c	net/sched: act_tunnel_key: add support for "don't fragment"	2023-03-30 23:24:24 -07:00
act_vlan.c	net/sched: avoid indirect act functions on retpoline kernels	2022-12-09 09:18:07 +00:00
cls_api.c	net/sched: cls_api: Fix lockup on flushing explicitly created chain	2023-06-14 23:03:16 -07:00
cls_basic.c	net/sched: avoid indirect classify functions on retpoline kernels	2022-12-09 09:18:07 +00:00
cls_bpf.c	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error	2023-07-17 07:33:39 +01:00
cls_cgroup.c	net/sched: avoid indirect classify functions on retpoline kernels	2022-12-09 09:18:07 +00:00
cls_flow.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
cls_flower.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-03 14:34:37 -07:00
cls_fw.c	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:36 -07:00
cls_matchall.c	net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms	2023-07-17 07:33:38 +01:00
cls_route.c	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:37 -07:00
cls_u32.c	net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:36 -07:00
em_canid.c
em_cmp.c	net: sched: fix misspellings using misspell-fixer tool	2020-11-10 17:00:28 -08:00
em_ipset.c
em_ipt.c
em_meta.c	net: annotate data-races around sk->sk_lingertime	2023-08-21 07:41:57 +01:00
em_nbyte.c	net: sched: Return the correct errno code	2021-02-06 11:15:28 -08:00
em_text.c
em_u32.c
ematch.c	net_sched: reject TCF_EM_SIMPLE case for complex ematch module	2022-12-19 09:43:18 +00:00
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
Makefile	net/sched: Retire rsvp classifier	2023-02-16 09:27:07 +01:00
sch_api.c	net/sched: fix a qdisc modification with ambiguous command request	2023-08-23 09:44:48 +01:00
sch_blackhole.c
sch_cake.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
sch_cbs.c	net/sched: use tc_qdisc_stats_dump() in qdisc	2022-09-22 17:34:10 -07:00
sch_choke.c	treewide: use get_random_u32_below() instead of deprecated function	2022-11-18 02:15:15 +01:00
sch_codel.c	net: sched: remove redundant NULL check in change hook function	2022-09-01 08:06:45 +02:00
sch_drr.c	net/sched: sch_drr: warn about class in use while deleting	2023-08-01 10:47:24 +02:00
sch_etf.c	net: sched: etf: remove true check in etf_enable_offload()	2022-09-01 20:08:32 -07:00
sch_ets.c	net/sched: use tc_qdisc_stats_dump() in qdisc	2022-09-22 17:34:10 -07:00
sch_fifo.c	net_sched: fix NULL deref in fifo_set_limit()	2021-10-01 14:59:10 -07:00
sch_fq_codel.c	Revert "net: sched: fq_codel: remove redundant resource cleanup in fq_codel_init()"	2022-10-19 13:47:09 +01:00
sch_fq_pie.c	net/sched: fq_pie: avoid stalls in fq_pie_timer()	2023-08-31 11:21:52 +02:00
sch_fq.c	net/sched: sch_fq: fix integer overflow of "credit"	2023-04-21 20:24:29 -07:00
sch_frag.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
sch_generic.c	net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting	2023-06-14 10:31:39 +02:00
sch_gred.c	net: sched: gred: prevent races when adding offloads to stats	2023-01-18 20:28:25 -08:00
sch_hfsc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-08-29 07:44:56 +02:00
sch_hhf.c	net: sched: remove redundant NULL check in change hook function	2022-09-01 08:06:45 +02:00
sch_htb.c	net/sched: sch_htb: warn about class in use while deleting	2023-08-01 10:47:24 +02:00
sch_ingress.c	tcx: Fix splat in ingress_destroy upon tcx_entry_free	2023-07-24 11:42:35 -07:00
sch_mq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_mqprio_lib.c	net/sched: mqprio: allow per-TC user input of FP adminStatus	2023-04-13 22:22:10 -07:00
sch_mqprio_lib.h	net/sched: mqprio: allow per-TC user input of FP adminStatus	2023-04-13 22:22:10 -07:00
sch_mqprio.c	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64	2023-07-26 22:08:14 -07:00
sch_multiq.c	net/sched: use tc_qdisc_stats_dump() in qdisc	2022-09-22 17:34:10 -07:00
sch_netem.c	netem: use seeded PRNG for correlated loss events	2023-08-17 19:15:06 -07:00
sch_pie.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_plug.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-05 08:54:12 +02:00
sch_prio.c	net/sched: use tc_qdisc_stats_dump() in qdisc	2022-09-22 17:34:10 -07:00
sch_qfq.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-05 08:54:12 +02:00
sch_red.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_sfb.c	Networking fixes for 6.1-rc2, including fixes from netfilter	2022-10-20 17:24:59 -07:00
sch_sfq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_skbprio.c	net/sched: use tc_qdisc_stats_dump() in qdisc	2022-09-22 17:34:10 -07:00
sch_taprio.c	net/sched: taprio: dump class stats for the actual q->qdiscs[]	2023-08-09 15:59:21 -07:00
sch_tbf.c	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
sch_teql.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00