linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00

No description

C 96.9%
Assembly 0.9%
Rust 0.6%
Shell 0.6%
Python 0.5%
Other 0.3%

Find a file

Jamal Hadi Salim deda09c054 net: sched: Disallow replacing of child qdisc from one parent to another [ Upstream commit `bc50835e83` ] Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" \| socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" \| socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Joint work with Lion Ackermann <nnamrec@gmail.com> Fixes: `1da177e4c3` ("Linux-2.6.12-rc2") Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2025-02-21 13:49:06 +01:00
arch	powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active	2025-02-21 13:48:52 +01:00
block	partitions: ldm: remove the initial kernel-doc notation	2025-02-21 13:48:54 +01:00
certs	certs: Fix build error when PKCS#11 URI contains semicolon	2023-02-09 11:28:11 +01:00
crypto	crypto: api - Add crypto_clone_tfm	2024-12-14 19:53:51 +01:00
Documentation	dt-bindings: mfd: bd71815: Fix rsense and typos	2025-02-21 13:49:00 +01:00
drivers	net/mlxfw: Drop hard coded max FW flash image size	2025-02-21 13:49:05 +01:00
fs	afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call	2025-02-21 13:48:54 +01:00
include	wifi: mac80211: Fix common size calculation for ML element	2025-02-21 13:49:03 +01:00
init	initramfs: avoid filename buffer overrun	2024-12-14 19:53:14 +01:00
io_uring	io_uring: fix waiters missing wake ups	2025-02-01 18:30:09 +01:00
ipc	ipc: fix memleak if msg_init_ns failed in create_ipc_ns	2024-12-14 19:54:06 +01:00
kernel	cpufreq: schedutil: Fix superfluous updates caused by need_freq_update	2025-02-21 13:49:01 +01:00
lib	lib: stackinit: hide never-taken branch from compiler	2024-12-14 19:54:37 +01:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	filemap: avoid truncating 64-bit offset to 32 bits	2025-01-23 17:17:14 +01:00
net	net: sched: Disallow replacing of child qdisc from one parent to another	2025-02-21 13:49:06 +01:00
rust	rust: macros: provide correct provenance when constructing THIS_MODULE	2024-10-17 15:22:24 +02:00
samples	samples/landlock: Fix possible NULL dereference in parse_path()	2025-02-21 13:49:03 +01:00
scripts	scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity	2025-01-17 13:34:38 +01:00
security	landlock: Handle weird files	2025-02-21 13:49:04 +01:00
sound	ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation	2025-02-01 18:30:11 +01:00
tools	selftests/landlock: Fix error message	2025-02-21 13:49:05 +01:00
usr	usr/gen_init_cpio.c: remove unnecessary -1 values from int file	2022-10-03 14:21:44 -07:00
virt	KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()	2024-06-27 13:46:21 +02:00
.clang-format	inet: ping: use hlist_nulls rcu iterator during lookup	2022-12-01 12:42:46 +01:00
.cocciconfig	scripts: add Linux .cocciconfig for coccinelle	2016-07-22 12:13:39 +02:00
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	Remove *.orig pattern from .gitignore	2024-10-17 15:21:15 +02:00
.mailmap	9 hotfixes. 6 for MM, 3 for other areas. Four of these patches address	2022-12-10 17:10:52 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Remove Michal Marek from Kbuild maintainers	2022-11-16 14:53:00 +09:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: add leah to 6.1 MAINTAINERS file	2024-05-17 11:56:16 +02:00
Makefile	Linux 6.1.128	2025-02-01 18:30:12 +01:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.