net/sched: Abort __tc_modify_qdisc if parent class does not exist

Lion's patch [1] revealed an ancient bug in the qdisc API.
Whenever a user creates/modifies a qdisc specifying as a parent another
qdisc, the qdisc API will, during grafting, detect that the user is
not trying to attach to a class and reject. However grafting is
performed after qdisc_create (and thus the qdiscs' init callback) is
executed. In qdiscs that eventually call qdisc_tree_reduce_backlog
during init or change (such as fq, hhf, choke, etc), an issue
arises. For example, executing the following commands:

sudo tc qdisc add dev lo root handle a: htb default 2
sudo tc qdisc add dev lo parent a: handle beef fq

Qdiscs such as fq, hhf, choke, etc unconditionally invoke
qdisc_tree_reduce_backlog() in their control path init() or change() which
then causes a failure to find the child class; however, that does not stop
the unconditional invocation of the assumed child qdisc's qlen_notify with
a null class. All these qdiscs make the assumption that class is non-null.

The solution is ensure that qdisc_leaf() which looks up the parent
class, and is invoked prior to qdisc_create(), should return failure on
not finding the class.
In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the
parentid doesn't correspond to a class, so that we can detect it
earlier on and abort before qdisc_create is called.

[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/

Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs")
Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/
Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/
Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/
Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/
Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index d8a33486c511a479d63b5ebe1678c843ee82774b..241e86cec9c50d41c7072b457c502c96212a1f44 100644 (file)
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -336,17 +336,22 @@ out:
        return q;
 }
 
-static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
+static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid,
+                               struct netlink_ext_ack *extack)
 {
        unsigned long cl;
        const struct Qdisc_class_ops *cops = p->ops->cl_ops;
 
-       if (cops == NULL)
-               return NULL;
+       if (cops == NULL) {
+               NL_SET_ERR_MSG(extack, "Parent qdisc is not classful");
+               return ERR_PTR(-EOPNOTSUPP);
+       }
        cl = cops->find(p, classid);
 
-       if (cl == 0)
-               return NULL;
+       if (cl == 0) {
+               NL_SET_ERR_MSG(extack, "Specified class not found");
+               return ERR_PTR(-ENOENT);
+       }
        return cops->leaf(p, cl);
 }
 
@@ -1490,7 +1495,7 @@ static int __tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
                                        NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid");
                                        return -ENOENT;
                                }
-                               q = qdisc_leaf(p, clid);
+                               q = qdisc_leaf(p, clid, extack);
                        } else if (dev_ingress_queue(dev)) {
                                q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
                        }
@@ -1501,6 +1506,8 @@ static int __tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
                        NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
                        return -ENOENT;
                }
+               if (IS_ERR(q))
+                       return PTR_ERR(q);
 
                if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
                        NL_SET_ERR_MSG(extack, "Invalid handle");
@@ -1602,7 +1609,9 @@ static int __tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
                                        NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
                                        return -ENOENT;
                                }
-                               q = qdisc_leaf(p, clid);
+                               q = qdisc_leaf(p, clid, extack);
+                               if (IS_ERR(q))
+                                       return PTR_ERR(q);
                        } else if (dev_ingress_queue_create(dev)) {
                                q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
                        }