Victor Nogueira 4c691d1b6b net/sched: Abort __tc_modify_qdisc if parent class does not exist ... [ Upstream commit ffdde7bf5a ] Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ Fixes: 5e50da01d0 ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/ Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/ Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/ Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/ Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/ Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-07-17 18:35:11 +02:00
..
act_api.c	net: use unrcu_pointer() helper	2024-12-09 10:32:10 +01:00
act_bpf.c	net: Rename mono_delivery_time to tstamp_type for scalabilty	2025-05-09 09:43:57 +02:00
act_connmark.c
act_csum.c
act_ct.c	sched: act_ct: take care of padding in struct zones_ht_key	2024-08-11 12:47:18 +02:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_ipt.c
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c
act_mpls.c
act_nat.c
act_pedit.c
act_police.c
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c
act_tunnel_key.c	net: fix geneve_opt length integer overflow	2025-04-10 14:37:40 +02:00
act_vlan.c
cls_api.c	tc: Ensure we have enough buffer space when sending filter netlink notifications	2025-04-25 10:45:06 +02:00
cls_basic.c
cls_bpf.c	net: Rename mono_delivery_time to tstamp_type for scalabilty	2025-05-09 09:43:57 +02:00
cls_cgroup.c
cls_flow.c	net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute	2025-01-17 13:36:12 +01:00
cls_flower.c	net: fix geneve_opt length integer overflow	2025-04-10 14:37:40 +02:00
cls_fw.c
cls_matchall.c
cls_route.c
cls_u32.c	net: sched: cls_u32: Fix u32's systematic failure to free IDR entries for hnodes.	2024-11-22 15:38:32 +01:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig
Makefile
sch_api.c	net/sched: Abort __tc_modify_qdisc if parent class does not exist	2025-07-17 18:35:11 +02:00
sch_blackhole.c
sch_cake.c	sched: sch_cake: add bounds checks to host bulk flow fairness counts	2025-01-17 13:36:15 +01:00
sch_cbs.c	net/sched: cbs: Fix integer overflow in cbs_set_port_rate()	2024-12-14 20:00:03 +01:00
sch_choke.c	net: sched: fix ordering of qlen adjustment	2024-12-27 13:58:41 +01:00
sch_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_drr.c	sch_drr: make drr_qlen_notify() idempotent	2025-05-09 09:44:04 +02:00
sch_etf.c
sch_ets.c	net_sched: ets: fix a race in ets_qdisc_change()	2025-06-19 15:28:43 +02:00
sch_fifo.c	pfifo_tail_enqueue: Drop new packet when sch->limit == 0	2025-03-13 12:58:40 +01:00
sch_fq_codel.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_fq_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_fq.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_frag.c
sch_generic.c	net: fix races in netdev_tx_sent_queue()/dev_watchdog()	2024-11-01 01:58:29 +01:00
sch_gred.c	sched: address a potential NULL pointer dereference in the GRED scheduler.	2025-03-22 12:50:38 -07:00
sch_hfsc.c	net_sched: hfsc: Address reentrant enqueue adding class to eltree twice	2025-06-04 14:42:24 +02:00
sch_hhf.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_htb.c	sch_htb: make htb_deactivate() idempotent	2025-05-18 08:24:04 +02:00
sch_ingress.c	bpf: Fix too early release of tcx_entry	2024-07-18 13:21:12 +02:00
sch_mq.c
sch_mqprio_lib.c
sch_mqprio_lib.h
sch_mqprio.c
sch_multiq.c	net: sched: sch_multiq: fix possible OOB write in multiq_tune()	2024-06-21 14:38:16 +02:00
sch_netem.c	netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()	2025-02-17 09:40:14 +01:00
sch_pie.c	net_sched: Flush gso_skb list too during ->change()	2025-05-22 14:12:15 +02:00
sch_plug.c
sch_prio.c	net_sched: prio: fix a race in prio_tune()	2025-06-19 15:28:43 +02:00
sch_qfq.c	sch_qfq: make qfq_qlen_notify() idempotent	2025-05-09 09:44:04 +02:00
sch_red.c	net_sched: red: fix a race in __red_change()	2025-06-19 15:28:43 +02:00
sch_sfb.c
sch_sfq.c	net_sched: sch_sfq: reject invalid perturb period	2025-06-27 11:08:59 +01:00
sch_skbprio.c	net_sched: skbprio: Remove overly strict queue assertions	2025-04-10 14:37:39 +02:00
sch_taprio.c	net/sched: fix use-after-free in taprio_dev_notifier	2025-06-27 11:08:48 +01:00
sch_tbf.c	net_sched: tbf: fix a race in tbf_change()	2025-06-19 15:28:43 +02:00
sch_teql.c