Victor Nogueira
145fe6d33c
net/sched: Abort __tc_modify_qdisc if parent class does not exist
[ Upstream commit ffdde7bf5a439aaa1955ebd581f5c64ab1533963 ]
Lion's patch [1] revealed an ancient bug in the qdisc API.
Whenever a user creates/modifies a qdisc specifying as a parent another
qdisc, the qdisc API will, during grafting, detect that the user is
not trying to attach to a class and reject. However grafting is
performed after qdisc_create (and thus the qdiscs' init callback) is
executed. In qdiscs that eventually call qdisc_tree_reduce_backlog
during init or change (such as fq, hhf, choke, etc), an issue
arises. For example, executing the following commands:
sudo tc qdisc add dev lo root handle a: htb default 2
sudo tc qdisc add dev lo parent a: handle beef fq
Qdiscs such as fq, hhf, choke, etc unconditionally invoke
qdisc_tree_reduce_backlog() in their control path init() or change() which
then causes a failure to find the child class; however, that does not stop
the unconditional invocation of the assumed child qdisc's qlen_notify with
a null class. All these qdiscs make the assumption that class is non-null.
The solution is ensure that qdisc_leaf() which looks up the parent
class, and is invoked prior to qdisc_create(), should return failure on
not finding the class.
In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the
parentid doesn't correspond to a class, so that we can detect it
earlier on and abort before qdisc_create is called.
[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/
Fixes: 5e50da01d0 ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs")
Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/
Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/
Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/
Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/
Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[uli: backport to 4.19]
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2025-08-18 09:18:13 +02:00
..
2020-01-27 14:50:41 +01:00
2024-12-05 10:59:42 +01:00
2025-03-11 08:34:57 +01:00
2025-06-04 11:49:01 +02:00
2025-08-13 09:44:39 +02:00
2025-08-13 09:44:38 +02:00
2022-04-27 13:39:46 +02:00
2025-05-08 11:55:41 +02:00
2025-08-13 09:44:36 +02:00
2022-11-25 17:40:29 +01:00
2020-01-27 14:50:51 +01:00
2025-07-17 10:10:40 +02:00
2023-03-17 08:31:44 +01:00
2025-07-17 10:07:58 +02:00
2024-07-18 11:39:38 +02:00
2025-07-17 10:08:04 +02:00
2022-03-08 19:04:10 +01:00
2025-03-11 08:35:00 +01:00
2023-06-21 15:39:57 +02:00
2020-04-23 10:30:24 +02:00
2024-09-12 11:02:52 +02:00
2024-05-17 11:42:37 +02:00
2024-03-26 18:22:42 -04:00
2025-02-07 03:34:23 +01:00
2024-01-08 11:27:34 +01:00
2025-07-17 10:08:04 +02:00
2025-08-13 09:44:39 +02:00
2024-09-04 13:13:03 +02:00
2024-09-04 13:13:05 +02:00
2023-08-30 16:31:48 +02:00
2024-05-17 11:42:38 +02:00
2021-02-10 09:21:06 +01:00
2025-07-17 10:07:58 +02:00
2025-08-13 09:44:37 +02:00
2025-03-11 08:34:59 +01:00
2025-07-17 10:08:05 +02:00
2025-07-17 10:08:00 +02:00
2025-07-17 10:07:59 +02:00
2025-07-17 10:08:02 +02:00
2025-08-13 09:44:39 +02:00
2025-02-07 03:34:27 +01:00
2025-07-17 10:08:02 +02:00
2024-05-17 11:42:38 +02:00
2025-07-17 10:07:55 +02:00
2025-02-07 03:34:27 +01:00
2024-05-17 11:42:42 +02:00
2023-12-13 17:42:20 +01:00
2024-11-08 16:19:08 +01:00
2024-09-04 13:13:08 +02:00
2024-12-05 10:59:33 +01:00
2025-08-13 09:44:37 +02:00
2025-08-13 09:44:38 +02:00
2025-08-18 09:18:13 +02:00
2025-07-17 10:08:04 +02:00
2025-02-07 03:34:25 +01:00
2025-07-17 10:08:03 +02:00
2025-08-13 09:44:38 +02:00
2022-07-29 17:10:32 +02:00
2024-09-12 11:02:51 +02:00
2025-08-13 09:44:36 +02:00
2025-04-04 11:11:29 +02:00
2024-03-26 18:22:37 -04:00
2024-07-05 09:00:23 +02:00
2025-05-08 11:55:40 +02:00
2021-06-30 08:48:13 -04:00
2023-06-21 15:39:57 +02:00
2023-06-21 15:39:57 +02:00
2024-01-15 18:23:42 +01:00