Victor Nogueira 25452638f1 net/sched: Abort __tc_modify_qdisc if parent class does not exist ... [ Upstream commit ffdde7bf5a ] Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ Fixes: 5e50da01d0 ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/ Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/ Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/ Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/ Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/ Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-07-17 18:30:47 +02:00
..
act_api.c	net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()	2024-07-05 09:14:30 +02:00
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c	sched: act_ct: take care of padding in struct zones_ht_key	2024-08-19 05:45:31 +02:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_ipt.c
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: don't override retval if we already lost the skb	2025-05-09 09:39:37 +02:00
act_mpls.c
act_nat.c
act_pedit.c
act_police.c
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c	net/sched: act_skbmod: prevent kernel-infoleak	2024-04-10 16:19:38 +02:00
act_tunnel_key.c	net: fix geneve_opt length integer overflow	2025-04-10 14:32:05 +02:00
act_vlan.c
cls_api.c
cls_basic.c
cls_bpf.c	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error	2023-07-27 08:47:00 +02:00
cls_cgroup.c
cls_flow.c	net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute	2025-01-23 17:15:49 +01:00
cls_flower.c	net: fix geneve_opt length integer overflow	2025-04-10 14:32:05 +02:00
cls_fw.c	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free	2023-08-11 15:13:52 +02:00
cls_matchall.c
cls_route.c	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free	2023-08-11 15:13:52 +02:00
cls_u32.c	net: sched: cls_u32: Fix allocation size in u32_init()	2023-11-08 17:26:45 +01:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c
em_nbyte.c
em_text.c	net: sched: em_text: fix possible memory leak in em_text_destroy()	2024-01-15 18:51:12 +01:00
em_u32.c
ematch.c
Kconfig	net/sched: Retire dsmark qdisc	2024-03-01 13:21:42 +01:00
Makefile	net/sched: Retire dsmark qdisc	2024-03-01 13:21:42 +01:00
sch_api.c	net/sched: Abort __tc_modify_qdisc if parent class does not exist	2025-07-17 18:30:47 +02:00
sch_blackhole.c
sch_cake.c	sched: sch_cake: add bounds checks to host bulk flow fairness counts	2025-03-13 12:51:12 +01:00
sch_cbs.c	net/sched: cbs: Fix integer overflow in cbs_set_port_rate()	2024-12-14 19:51:36 +01:00
sch_choke.c	net: sched: fix ordering of qlen adjustment	2025-01-09 13:28:29 +01:00
sch_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_drr.c	net_sched: drr: Fix double list add in class with netem as child qdisc	2025-05-09 09:39:38 +02:00
sch_etf.c
sch_ets.c	net_sched: ets: fix a race in ets_qdisc_change()	2025-06-27 11:05:20 +01:00
sch_fifo.c	pfifo_tail_enqueue: Drop new packet when sch->limit == 0	2025-03-13 12:51:00 +01:00
sch_fq_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_fq_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_fq.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_frag.c
sch_generic.c
sch_gred.c
sch_hfsc.c	net_sched: hfsc: Address reentrant enqueue adding class to eltree twice	2025-06-04 14:38:07 +02:00
sch_hhf.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_htb.c
sch_ingress.c
sch_mq.c
sch_mqprio.c	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64	2023-08-03 10:22:36 +02:00
sch_multiq.c	net: sched: sch_multiq: fix possible OOB write in multiq_tune()	2024-07-05 09:14:06 +02:00
sch_netem.c	netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()	2025-03-13 12:50:23 +01:00
sch_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:08:22 +02:00
sch_plug.c	net: sched: sch_qfq: Fix UAF in qfq_dequeue()	2023-09-19 12:22:59 +02:00
sch_prio.c	net_sched: prio: fix a race in prio_tune()	2025-06-27 11:05:20 +01:00
sch_qfq.c	net_sched: qfq: Fix double list add in class with netem as child qdisc	2025-05-09 09:39:39 +02:00
sch_red.c	net_sched: red: fix a race in __red_change()	2025-06-27 11:05:20 +01:00
sch_sfb.c
sch_sfq.c	net_sched: sch_sfq: reject invalid perturb period	2025-06-27 11:05:37 +01:00
sch_skbprio.c	net_sched: skbprio: Remove overly strict queue assertions	2025-04-10 14:32:04 +02:00
sch_taprio.c	net: sched: fix use-after-free in taprio_change()	2024-11-01 01:52:37 +01:00
sch_tbf.c	net_sched: tbf: fix a race in tbf_change()	2025-06-27 11:05:20 +01:00
sch_teql.c