netdev - Re: [PATCH net] net/sched: sch_hfsc: Ensure inner classes have fsc curve

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 24 Aug 2023 10:21:43 -0400
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Budimir Markovic <markovicbudimir@...il.com>
Cc: netdev@...r.kernel.org
Subject: Re: [PATCH net] net/sched: sch_hfsc: Ensure inner classes have fsc curve

On Thu, Aug 24, 2023 at 4:50 AM Budimir Markovic
<markovicbudimir@...il.com> wrote:
>
> HFSC assumes that inner classes have an fsc curve, but it is currently
> possible for classes without an fsc curve to become parents. This leads
> to bugs including a use-after-free.
>
> Don't allow non-root classes without HFSC_FSC to become parents.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Budimir Markovic <markovicbudimir@...il.com>
> Signed-off-by: Budimir Markovic <markovicbudimir@...il.com>

Acked-by: Jamal Hadi Salim <jhs@...atatu.com>

cheers,
jamal

> ---
>  net/sched/sch_hfsc.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
> index 70b0c5873..d14cff8d4 100644
> --- a/net/sched/sch_hfsc.c
> +++ b/net/sched/sch_hfsc.c
> @@ -1012,6 +1012,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
>                 if (parent == NULL)
>                         return -ENOENT;
>         }
> +       if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
> +               NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
> +               return -EINVAL;
> +       }
>
>         if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
>                 return -EINVAL;
> --
> 2.41.0
>