Message-ID: <2025071933-CVE-2025-38350-262a@gregkh>
Date: Sat, 19 Jul 2025 08:46:34 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Always pass notifications when child class becomes empty

Certain classful qdiscs may invoke their classes' dequeue handler on an
enqueue operation. This may unexpectedly empty the child qdisc and thus
make an in-flight class passive via qlen_notify(). Most qdiscs do not
expect such behaviour at this point in time and may re-activate the
class eventually anyways which will lead to a use-after-free.

The referenced fix commit attempted to fix this behavior for the HFSC
case by moving the backlog accounting around, though this turned out to
be incomplete since the parent's parent may run into the issue too.
The following reproducer demonstrates this use-after-free:

    tc qdisc add dev lo root handle 1: drr
    tc filter add dev lo parent 1: basic classid 1:1
    tc class add dev lo parent 1: classid 1:1 drr
    tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1
    tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0
    tc qdisc add dev lo parent 2:1 handle 3: netem
    tc qdisc add dev lo parent 3:1 handle 4: blackhole

    echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888
    tc class delete dev lo classid 1:1
    echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888

Since backlog accounting issues leading to a use-after-frees on stale
class pointers is a recurring pattern at this point, this patch takes
a different approach. Instead of trying to fix the accounting, the patch
ensures that qdisc_tree_reduce_backlog always calls qlen_notify when
the child qdisc is empty. This solves the problem because deletion of
qdiscs always involves a call to qdisc_reset() and / or
qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing
the following qdisc_tree_reduce_backlog() to report to the parent. Note
that this may call qlen_notify on passive classes multiple times. This
is not a problem after the recent patch series that made all the
classful qdiscs qlen_notify() handlers idempotent.

The Linux kernel CVE team has assigned CVE-2025-38350 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4.294 with commit 1034e3310752e8675e313f7271b348914008719a and fixed in 5.4.296 with commit 3b290923ad2b23596208c1e29520badef4356a43
	Issue introduced in 5.10.238 with commit f9f593e34d2fb67644372c8f7b033bdc622ad228 and fixed in 5.10.240 with commit e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7
	Issue introduced in 5.15.185 with commit 89c301e929a0db14ebd94b4d97764ce1d6981653 and fixed in 5.15.187 with commit e269f29e9395527bc00c213c6b15da04ebb35070
	Issue introduced in 6.1.141 with commit f1dde3eb17dc1b8bd07aed00004b1e05fc87a3d4 and fixed in 6.1.144 with commit 7874c9c132e906a52a187d045995b115973c93fb
	Issue introduced in 6.6.93 with commit 93c276942e75de0e5bc91576300d292e968f5a02 and fixed in 6.6.97 with commit f680a4643c6f71e758d8fe0431a958e9a6a4f59d
	Issue introduced in 6.12.31 with commit 49b21795b8e5654a7df3d910a12e1060da4c04cf and fixed in 6.12.37 with commit a553afd91f55ff39b1e8a1c4989a29394c9e0472
	Issue introduced in 6.15 with commit 3f981138109f63232a5fb7165938d4c945cc1b9d and fixed in 6.15.6 with commit a44acdd9e84a211989ff4b9b92bf3545d8456ad5
	Issue introduced in 6.15 with commit 3f981138109f63232a5fb7165938d4c945cc1b9d and fixed in 6.16-rc5 with commit 103406b38c600fec1fe375a77b27d87e314aea09
	Issue introduced in 6.14.9 with commit 3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38350
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sched/sch_api.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3b290923ad2b23596208c1e29520badef4356a43
	https://git.kernel.org/stable/c/e9921b57dca05ac5f4fa1fa8e993d4f0ee52e2b7
	https://git.kernel.org/stable/c/e269f29e9395527bc00c213c6b15da04ebb35070
	https://git.kernel.org/stable/c/7874c9c132e906a52a187d045995b115973c93fb
	https://git.kernel.org/stable/c/f680a4643c6f71e758d8fe0431a958e9a6a4f59d
	https://git.kernel.org/stable/c/a553afd91f55ff39b1e8a1c4989a29394c9e0472
	https://git.kernel.org/stable/c/a44acdd9e84a211989ff4b9b92bf3545d8456ad5
	https://git.kernel.org/stable/c/103406b38c600fec1fe375a77b27d87e314aea09

Powered by blists - more mailing lists