kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/sched
History
Victor Nogueira 02783a37cb net/sched: ets: Remove drr class from the active list if it changes to strict 
[ Upstream commit b1e125ae42 ]

Whenever a user issues an ets qdisc change command, transforming a
drr class into a strict one, the ets code isn't checking whether that
class was in the active list and removing it. This means that, if a
user changes a strict class (which was in the active list) back to a drr
one, that class will be added twice to the active list [1].

Doing so with the following commands:

tc qdisc add dev lo root handle 1: ets bands 2 strict 1
tc qdisc add dev lo parent 1:2 handle 20: \
    tbf rate 8bit burst 100b latency 1s
tc filter add dev lo parent 1: basic classid 1:2
ping -c1 -W0.01 -s 56 127.0.0.1
tc qdisc change dev lo root handle 1: ets bands 2 strict 2
tc qdisc change dev lo root handle 1: ets bands 2 strict 1
ping -c1 -W0.01 -s 56 127.0.0.1

Will trigger the following splat with list debug turned on:

[   59.279014][  T365] ------------[ cut here ]------------
[   59.279452][  T365] list_add double add: new=ffff88801d60e350, prev=ffff88801d60e350, next=ffff88801d60e2c0.
[   59.280153][  T365] WARNING: CPU: 3 PID: 365 at lib/list_debug.c:35 __list_add_valid_or_report+0x17f/0x220
[   59.280860][  T365] Modules linked in:
[   59.281165][  T365] CPU: 3 UID: 0 PID: 365 Comm: tc Not tainted 6.18.0-rc7-00105-g7e9f13163c13-dirty #239 PREEMPT(voluntary)
[   59.281977][  T365] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[   59.282391][  T365] RIP: 0010:__list_add_valid_or_report+0x17f/0x220
[   59.282842][  T365] Code: 89 c6 e8 d4 b7 0d ff 90 0f 0b 90 90 31 c0 e9 31 ff ff ff 90 48 c7 c7 e0 a0 22 9f 48 89 f2 48 89 c1 4c 89 c6 e8 b2 b7 0d ff 90 <0f> 0b 90 90 31 c0 e9 0f ff ff ff 48 89 f7 48 89 44 24 10 4c 89 44
...
[   59.288812][  T365] Call Trace:
[   59.289056][  T365]  <TASK>
[   59.289224][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.289546][  T365]  ets_qdisc_change+0xd2b/0x1e80
[   59.289891][  T365]  ? __lock_acquire+0x7e7/0x1be0
[   59.290223][  T365]  ? __pfx_ets_qdisc_change+0x10/0x10
[   59.290546][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.290898][  T365]  ? __mutex_trylock_common+0xda/0x240
[   59.291228][  T365]  ? __pfx___mutex_trylock_common+0x10/0x10
[   59.291655][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.291993][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.292313][  T365]  ? trace_contention_end+0xc8/0x110
[   59.292656][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.293022][  T365]  ? srso_alias_return_thunk+0x5/0xfbef5
[   59.293351][  T365]  tc_modify_qdisc+0x63a/0x1cf0

Fix this by always checking and removing an ets class from the active list
when changing it to strict.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/tree/net/sched/sch_ets.c?id=ce052b9402e461a9aded599f5b47e76bc727f7de#n663

Fixes: cd9b50adc6 ("net/sched: ets: fix crash when flipping from 'strict' to 'quantum'")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/20251208190125.1868423-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-19 13:09:44 +01:00
..
act_api.c net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() 2024-07-05 09:14:30 +02:00
act_bpf.c bpf: Add bpf_prog_run_data_pointers() 2025-12-07 06:09:29 +09:00
act_connmark.c net/sched: act_connmark: handle errno on tcf_idr_check_alloc 2025-12-07 06:09:30 +09:00
act_csum.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_ct.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_ctinfo.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_gact.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_gate.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_ife.c net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak 2025-12-07 06:09:28 +09:00
act_ipt.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_meta_mark.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbprio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_mirred.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_mpls.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_nat.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_pedit.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_police.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_sample.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_simple.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_skbedit.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_skbmod.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_tunnel_key.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
act_vlan.c net: sched: act: move global static variable net_id to tc_action_ops 2025-12-07 06:09:28 +09:00
cls_api.c net/sched: cls_api: Fix lockup on flushing explicitly created chain 2023-06-21 15:59:18 +02:00
cls_basic.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_bpf.c bpf: Add bpf_prog_run_data_pointers() 2025-12-07 06:09:29 +09:00
cls_cgroup.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_flow.c net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute 2025-01-23 17:15:49 +01:00
cls_flower.c net: fix geneve_opt length integer overflow 2025-04-10 14:32:05 +02:00
cls_fw.c net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 15:13:52 +02:00
cls_matchall.c net_sched: refactor TC action init API 2021-08-02 10:24:38 +01:00
cls_route.c net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 15:13:52 +02:00
cls_u32.c net: sched: cls_u32: Fix allocation size in u32_init() 2023-11-08 17:26:45 +01:00
em_canid.c net: sched: kerneldoc fixes 2020-07-13 17:20:40 -07:00
em_cmp.c net: sched: fix misspellings using misspell-fixer tool 2020-11-10 17:00:28 -08:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_meta.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_nbyte.c net: sched: Return the correct errno code 2021-02-06 11:15:28 -08:00
em_text.c net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-01-15 18:51:12 +01:00
em_u32.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-31 13:14:39 +01:00
Kconfig net/sched: Retire dsmark qdisc 2024-03-01 13:21:42 +01:00
Makefile net/sched: Retire dsmark qdisc 2024-03-01 13:21:42 +01:00
sch_api.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-12-07 06:09:12 +09:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop 2026-01-19 13:09:36 +01:00
sch_cbs.c net/sched: cbs: Fix integer overflow in cbs_set_port_rate() 2024-12-14 19:51:36 +01:00
sch_choke.c net: sched: fix ordering of qlen adjustment 2025-01-09 13:28:29 +01:00
sch_codel.c codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() 2025-08-28 16:24:33 +02:00
sch_drr.c sch_drr: make drr_qlen_notify() idempotent 2025-08-28 16:24:33 +02:00
sch_etf.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00
sch_ets.c net/sched: ets: Remove drr class from the active list if it changes to strict 2026-01-19 13:09:44 +01:00
sch_fifo.c pfifo_tail_enqueue: Drop new packet when sch->limit == 0 2025-03-13 12:51:00 +01:00
sch_fq.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:08:22 +02:00
sch_fq_codel.c codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() 2025-08-28 16:24:33 +02:00
sch_fq_pie.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:08:22 +02:00
sch_frag.c net/sched: Extend qdisc control block with tc control block 2022-01-05 12:42:33 +01:00
sch_generic.c net_sched: limit try_bulk_dequeue_skb() batches 2025-12-07 06:09:28 +09:00
sch_gred.c net: sched: Fix spelling mistakes 2021-05-31 22:44:56 -07:00
sch_hfsc.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-12-07 06:09:12 +09:00
sch_hhf.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:08:22 +02:00
sch_htb.c net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate 2025-08-28 16:24:38 +02:00
sch_ingress.c net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs 2023-06-09 10:32:17 +02:00
sch_mq.c net: sched: update default qdisc visibility after Tx queue cnt changes 2021-11-18 19:16:10 +01:00
sch_mqprio.c net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 2023-08-03 10:22:36 +02:00
sch_multiq.c net: sched: sch_multiq: fix possible OOB write in multiq_tune() 2024-07-05 09:14:06 +02:00
sch_netem.c net/sched: Restrict conditions for adding duplicating netems to qdisc tree 2025-08-28 16:24:08 +02:00
sch_pie.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:08:22 +02:00
sch_plug.c net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-19 12:22:59 +02:00
sch_prio.c net_sched: prio: fix a race in prio_tune() 2025-06-27 11:05:20 +01:00
sch_qfq.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-12-07 06:09:12 +09:00
sch_red.c net_sched: red: fix a race in __red_change() 2025-06-27 11:05:20 +01:00
sch_sfb.c net: sched: sfb: fix null pointer access issue when sfb_init() fails 2022-10-29 10:12:57 +02:00
sch_sfq.c net_sched: sch_sfq: reject invalid perturb period 2025-06-27 11:05:37 +01:00
sch_skbprio.c net_sched: skbprio: Remove overly strict queue assertions 2025-04-10 14:32:04 +02:00
sch_taprio.c net: sched: fix use-after-free in taprio_change() 2024-11-01 01:52:37 +01:00
sch_tbf.c net_sched: tbf: fix a race in tbf_change() 2025-06-27 11:05:20 +01:00
sch_teql.c net: sched: delete duplicate cleanup of backlog and qlen 2022-10-29 10:12:57 +02:00