From: Greg Kroah-Hartman Date: Wed, 5 Mar 2025 14:23:17 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v6.6.81~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ba9c1cf3a5dc83fefd5dd1c1ed00e751b520beda;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch --- diff --git a/queue-5.4/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch b/queue-5.4/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch new file mode 100644 index 0000000000..293a20ee50 --- /dev/null +++ b/queue-5.4/pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch @@ -0,0 +1,68 @@ +From 647cef20e649c576dff271e018d5d15d998b629d Mon Sep 17 00:00:00 2001 +From: Quang Le +Date: Mon, 3 Feb 2025 16:58:38 -0800 +Subject: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 + +From: Quang Le + +commit 647cef20e649c576dff271e018d5d15d998b629d upstream. + +Expected behaviour: +In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a +packet in scheduler's queue and decrease scheduler's qlen by one. +Then, pfifo_tail_enqueue() enqueue new packet and increase +scheduler's qlen by one. Finally, pfifo_tail_enqueue() return +`NET_XMIT_CN` status code. + +Weird behaviour: +In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a +scheduler that has no packet, the 'drop a packet' step will do nothing. +This means the scheduler's qlen still has value equal 0. +Then, we continue to enqueue new packet and increase scheduler's qlen by +one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by +one and return `NET_XMIT_CN` status code. + +The problem is: +Let's say we have two qdiscs: Qdisc_A and Qdisc_B. + - Qdisc_A's type must have '->graft()' function to create parent/child relationship. + Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`. + - Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`. + - Qdisc_B is configured to have `sch->limit == 0`. + - Qdisc_A is configured to route the enqueued's packet to Qdisc_B. + +Enqueue packet through Qdisc_A will lead to: + - hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B) + - Qdisc_B->q.qlen += 1 + - pfifo_tail_enqueue() return `NET_XMIT_CN` + - hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A. + +The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1. +Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem. +This violate the design where parent's qlen should equal to the sum of its childrens'qlen. + +Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable. + +Fixes: 57dbb2d83d10 ("sched: add head drop fifo queue") +Reported-by: Quang Le +Signed-off-by: Quang Le +Signed-off-by: Cong Wang +Link: https://patch.msgid.link/20250204005841.223511-2-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_fifo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -38,6 +38,9 @@ static int pfifo_tail_enqueue(struct sk_ + { + unsigned int prev_backlog; + ++ if (unlikely(READ_ONCE(sch->limit) == 0)) ++ return qdisc_drop(skb, sch, to_free); ++ + if (likely(sch->q.qlen < sch->limit)) + return qdisc_enqueue_tail(skb, sch); + diff --git a/queue-5.4/series b/queue-5.4/series index e330018333..9c8a809219 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -259,3 +259,4 @@ usbnet-gl620a-fix-endpoint-checking-in-genelink_bind.patch phy-tegra-xusb-reset-vbus-id-override.patch phy-exynos5-usbdrd-fix-mpll_multiplier-and-ssc_refclksel-masks-in-refclk.patch sched-core-prevent-rescheduling-when-interrupts-are-disabled.patch +pfifo_tail_enqueue-drop-new-packet-when-sch-limit-0.patch