kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Victor Nogueira 554acc5a2e net_sched: ets: Fix double list add in class with netem as child qdisc 
[ Upstream commit 1a6d0c00fa ]

As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of ets, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.

In addition to checking for qlen being zero, this patch checks whether
the class was already added to the active_list (cl_is_active) before
doing the addition to cater for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/

Fixes: 37d9cf1a3c ("sched: Fix detection of empty queues in child qdiscs")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250425220710.3964791-4-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-05-09 09:39:38 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p 9p/xen: fix release of IRQ 2024-12-14 19:51:21 +01:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: don't propagate flags on open 2025-05-02 07:43:56 +02:00
appletalk appletalk: Fix Use-After-Free in atalk_ioctl 2023-12-20 15:17:37 +01:00
atm atm: Fix NULL pointer dereference 2025-04-10 14:31:55 +02:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:22:01 +02:00
batman-adv batman-adv: Ignore own maximum aggregation size during RX 2025-04-10 14:31:55 +02:00
bluetooth Bluetooth: SCO: Fix UAF on sco_sock_timeout 2025-05-02 07:44:25 +02:00
bpf bpf: Set run context for rawtp test_run callback 2024-07-05 09:14:06 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge net: bridge: xmit: make sure we have at least eth header len bytes 2024-11-14 13:13:40 +01:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:48:54 +01:00
can can: statistics: use atomic access in hot path 2025-04-10 14:32:03 +02:00
ceph libceph: fix race between delayed_work() and ceph_monc_stop() 2024-07-18 13:07:42 +02:00
core net: selftests: initialize TCP header and skb payload with zero 2025-05-02 07:44:30 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails 2025-05-02 07:44:11 +02:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool net: ethtool: Don't call .cleanup_data when prepare_data fails 2025-05-02 07:43:52 +02:00
hsr net: hsr: fix fill_frame_info() regression vs VLAN packets 2025-03-13 12:50:13 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 net: fix geneve_opt length integer overflow 2025-04-10 14:32:05 +02:00
ipv6 ipv6: release nexthop on device removal 2025-05-02 07:44:18 +02:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key net: af_key: fix sadb_x_filter validation 2023-08-26 14:23:32 +02:00
l2tp genetlink: hold RCU in genlmsg_mcast() 2024-11-01 01:52:34 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: do not use skb_get() before dev_queue_xmit() 2025-03-13 12:51:05 +01:00
mac80211 Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" 2025-05-02 07:44:09 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Set SOCK_RCU_FREE 2025-05-02 07:44:10 +02:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:57:09 +01:00
mptcp net: make sock_inuse_add() available 2025-05-02 07:44:20 +02:00
ncsi net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling 2025-03-13 12:50:33 +01:00
netfilter ipvs: properly dereference pe in ip_vs_add_service 2025-05-02 07:44:22 +02:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-01-25 14:52:33 -08:00
netlink netlink: terminate outstanding dump on socket close 2024-12-14 19:50:34 +01:00
netrom netrom: check buffer length before accessing it 2025-01-09 13:28:46 +01:00
nfc NFC: nci: Add bounds checking in nci_hci_create_pipe() 2025-03-13 12:50:32 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch openvswitch: fix lockup on tx to unregistering netdev with carrier 2025-05-02 07:44:22 +02:00
packet af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:28:47 +01:00
phonet phonet/pep: fix racy skb_queue_empty() use 2025-05-02 07:44:18 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds net:rds: Fix possible deadlock in rds_message_put 2024-09-04 13:23:39 +02:00
rfkill net: rfkill: gpio: Add check for clk_enable() 2024-12-14 19:50:58 +01:00
rose net: rose: lock the socket in rose_bind() 2025-03-13 12:50:22 +01:00
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-02-23 08:54:58 +01:00
sched net_sched: ets: Fix double list add in class with netem as child qdisc 2025-05-09 09:39:38 +02:00
sctp sctp: detect and prevent references to a freed transport in sendmsg 2025-05-02 07:44:04 +02:00
smc net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-03-13 12:49:57 +01:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 19:17:11 +01:00
sunrpc sunrpc: suppress warnings for unused procfs functions 2025-03-13 12:50:56 +01:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix NULL pointer dereference in tipc_mon_reinit_self() 2025-05-02 07:44:30 +02:00
tls net: tls: explicitly disallow disconnect 2025-05-02 07:43:52 +02:00
unix af_unix: Remove put_pid()/put_cred() in copy_peercred(). 2024-09-12 11:07:45 +02:00
vmw_vsock vsock: avoid timeout during connect() if the socket is closing 2025-04-10 14:32:04 +02:00
wireless wifi: nl80211: reject cooked mode if it is set along with other flags 2025-03-13 12:51:03 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm_output: Force software GSO only in tunnel mode 2025-04-10 14:31:53 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: explicitly clear the sk pointer, when pf->create fails 2024-10-17 15:12:00 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00