netdev - [Patch net 00/12] net_sched: make ->qlen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250320232211.485785-1-xiyou.wangcong@gmail.com>
Date: Thu, 20 Mar 2025 16:21:59 -0700
From: Cong Wang <xiyou.wangcong@...il.com>
To: netdev@...r.kernel.org
Cc: jhs@...atatu.com,
	jiri@...nulli.us,
	edumazet@...gle.com,
	gerrard.tai@...rlabs.sg,
	Cong Wang <xiyou.wangcong@...il.com>
Subject: [Patch net 00/12] net_sched: make ->qlen_notify() idempotent

Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.

Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check is no longer necessary.

Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 6
selftests for each type of Qdisc's we touch here.

All existing and new Qdisc selftests pass after this patchset.

Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")

---
Cong Wang (12):
  sch_htb: make htb_qlen_notify() idempotent
  sch_drr: make drr_qlen_notify() idempotent
  sch_hfsc: make hfsc_qlen_notify() idempotent
  sch_qfq: make qfq_qlen_notify() idempotent
  sch_ets: make est_qlen_notify() idempotent
  codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
  selftests/tc-testing: Add a test case for CODEL with HTB parent
  selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
  selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
  selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
  selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent

 net/sched/sch_codel.c                         |   5 +-
 net/sched/sch_drr.c                           |   7 +-
 net/sched/sch_ets.c                           |   8 +-
 net/sched/sch_fq_codel.c                      |   6 +-
 net/sched/sch_hfsc.c                          |   8 +-
 net/sched/sch_htb.c                           |   2 +
 net/sched/sch_qfq.c                           |   7 +-
 .../tc-testing/tc-tests/infra/qdiscs.json     | 188 +++++++++++++++++-
 8 files changed, 211 insertions(+), 20 deletions(-)

-- 
2.34.1