kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/net/sched
History
Eric Dumazet 6392e5f4b1 bpf: Add bpf_prog_run_data_pointers() 
[ Upstream commit 4ef9274362 ]

syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().

WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214

struct tc_skb_cb has been added in commit ec624fe740 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba4592 ("bpf: wire in data and data_end for
cls_act_bpf").

drop_reason was added later.

Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.

Fixes: ec624fe740 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-11-24 10:35:55 +01:00
..
act_api.c net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers 2024-10-23 11:31:27 +02:00
act_bpf.c bpf: Add bpf_prog_run_data_pointers() 2025-11-24 10:35:55 +01:00
act_connmark.c net: sched: act_connmark: initialize struct tc_ife to fix kernel leak 2025-11-24 10:35:51 +01:00
act_csum.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_ct.c sched: act_ct: avoid -Wflex-array-member-not-at-end warning 2024-08-12 17:54:24 -07:00
act_ctinfo.c net_sched: act_ctinfo: use atomic64_t for three counters 2025-08-15 12:13:43 +02:00
act_gact.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_gate.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_ife.c net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak 2025-11-24 10:35:52 +01:00
act_meta_mark.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbprio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_mirred.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-02-22 15:29:26 -08:00
act_mpls.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_nat.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_pedit.c net: sched: Annotate struct tc_pedit with __counted_by 2024-02-19 10:58:24 +00:00
act_police.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_sample.c net: sched: act_sample: add action cookie to sample 2024-07-05 17:45:47 -07:00
act_simple.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_skbedit.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
act_skbmod.c net/sched: act_skbmod: convert comma to semicolon 2024-07-11 17:12:15 -07:00
act_tunnel_key.c net: fix geneve_opt length integer overflow 2025-04-10 14:39:34 +02:00
act_vlan.c tc: adjust network header after 2nd vlan push 2024-08-27 11:37:42 +02:00
cls_api.c tc: Ensure we have enough buffer space when sending filter netlink notifications 2025-04-20 10:15:07 +02:00
cls_basic.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
cls_bpf.c bpf: Add bpf_prog_run_data_pointers() 2025-11-24 10:35:55 +01:00
cls_cgroup.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
cls_flow.c net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute 2025-01-17 13:40:37 +01:00
cls_flower.c net: fix geneve_opt length integer overflow 2025-04-10 14:39:34 +02:00
cls_fw.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
cls_matchall.c net: sched: refine software bypass handling in tc_run 2025-02-08 09:57:25 +01:00
cls_route.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
cls_u32.c net: sched: refine software bypass handling in tc_run 2025-02-08 09:57:25 +01:00
em_canid.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
em_cmp.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_meta.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
em_nbyte.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
em_text.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
em_u32.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-19 09:43:18 +00:00
Kconfig net: sched: Remove NET_ACT_IPT from Kconfig 2024-02-13 11:24:35 +01:00
Makefile net/sched: Retire ipt action 2024-01-02 12:41:16 +00:00
sch_api.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-11-02 22:15:20 +09:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit 2025-08-28 16:31:15 +02:00
sch_cbs.c net/sched: cbs: Fix integer overflow in cbs_set_port_rate() 2024-12-14 20:03:47 +01:00
sch_choke.c net: sched: fix ordering of qlen adjustment 2024-12-27 14:01:57 +01:00
sch_codel.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_drr.c sch_drr: make drr_qlen_notify() idempotent 2025-05-09 09:50:50 +02:00
sch_etf.c net_sched: sch_tfs: implement lockless etf_dump() 2024-04-19 11:34:07 +01:00
sch_ets.c net/sched: ets: use old 'nbands' while purging unused classes 2025-08-20 18:30:54 +02:00
sch_fifo.c pfifo_tail_enqueue: Drop new packet when sch->limit == 0 2025-02-17 10:05:01 +01:00
sch_fq.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_fq_codel.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_fq_pie.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_frag.c net: dst: remove unnecessary input parameter in dst_alloc and dst_init 2023-09-12 11:42:25 +02:00
sch_generic.c net_sched: limit try_bulk_dequeue_skb() batches 2025-11-24 10:35:52 +01:00
sch_gred.c sched: address a potential NULL pointer dereference in the GRED scheduler. 2025-03-22 12:54:10 -07:00
sch_hfsc.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-11-02 22:15:20 +09:00
sch_hhf.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_htb.c net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate 2025-08-28 16:31:15 +02:00
sch_ingress.c bpf: Fix too early release of tcx_entry 2024-07-08 14:07:31 -07:00
sch_mq.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-07 10:25:39 +01:00
sch_mqprio.c net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing 2025-08-15 12:14:07 +02:00
sch_mqprio_lib.c net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs 2023-11-01 21:49:09 -07:00
sch_mqprio_lib.h net/sched: mqprio: allow per-TC user input of FP adminStatus 2023-04-13 22:22:10 -07:00
sch_multiq.c net: sched: sch_multiq: fix possible OOB write in multiq_tune() 2024-06-05 10:50:19 +01:00
sch_netem.c net/sched: Restrict conditions for adding duplicating netems to qdisc tree 2025-08-15 12:13:43 +02:00
sch_pie.c net_sched: Flush gso_skb list too during ->change() 2025-05-22 14:29:39 +02:00
sch_plug.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
sch_prio.c net_sched: prio: fix a race in prio_tune() 2025-06-19 15:32:31 +02:00
sch_qfq.c net/sched: sch_qfq: Fix null-deref in agg_dequeue 2025-11-02 22:15:20 +09:00
sch_red.c net_sched: red: fix a race in __red_change() 2025-06-19 15:32:31 +02:00
sch_sfb.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
sch_sfq.c net_sched: sch_sfq: reject invalid perturb period 2025-06-27 11:11:38 +01:00
sch_skbprio.c net_sched: skbprio: Remove overly strict queue assertions 2025-04-10 14:39:33 +02:00
sch_taprio.c net/sched: taprio: enforce minimum value for picos_per_byte 2025-08-15 12:14:06 +02:00
sch_tbf.c net_sched: tbf: fix a race in tbf_change() 2025-06-19 15:32:31 +02:00
sch_teql.c net: annotate writes on dev->mtu from ndo_change_mtu() 2024-05-07 16:19:14 -07:00