[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250403211033.166059-1-xiyou.wangcong@gmail.com>
Date: Thu, 3 Apr 2025 14:10:22 -0700
From: Cong Wang <xiyou.wangcong@...il.com>
To: netdev@...r.kernel.org
Cc: jhs@...atatu.com,
jiri@...nulli.us,
victor@...atatu.com,
Cong Wang <xiyou.wangcong@...il.com>
Subject: [Patch net v2 00/11] net_sched: make ->qlen_notify() idempotent
Gerrard reported a vulnerability exists in fq_codel where manipulating
the MTU can cause codel_dequeue() to drop all packets. The parent qdisc's
sch->q.qlen is only updated via ->qlen_notify() if the fq_codel queue
remains non-empty after the drops. This discrepancy in qlen between
fq_codel and its parent can lead to a use-after-free condition.
Let's fix this by making all existing ->qlen_notify() idempotent so that
the sch->q.qlen check will be no longer necessary.
Patch 1~5 make all existing ->qlen_notify() idempotent to prepare for
patch 6 which removes the sch->q.qlen check. They are followed by 5
selftests for each type of Qdisc's we touch here.
All existing and new Qdisc selftests pass after this patchset.
Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM")
---
v2: drop the unstable CODEL selftest
Cong Wang (11):
sch_htb: make htb_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_qfq: make qfq_qlen_notify() idempotent
sch_ets: make est_qlen_notify() idempotent
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
selftests/tc-testing: Add a test case for FQ_CODEL with HTB parent
selftests/tc-testing: Add a test case for FQ_CODEL with QFQ parent
selftests/tc-testing: Add a test case for FQ_CODEL with HFSC parent
selftests/tc-testing: Add a test case for FQ_CODEL with DRR parent
selftests/tc-testing: Add a test case for FQ_CODEL with ETS parent
net/sched/sch_codel.c | 5 +-
net/sched/sch_drr.c | 7 +-
net/sched/sch_ets.c | 8 +-
net/sched/sch_fq_codel.c | 6 +-
net/sched/sch_hfsc.c | 8 +-
net/sched/sch_htb.c | 2 +
net/sched/sch_qfq.c | 7 +-
.../tc-testing/tc-tests/infra/qdiscs.json | 155 ++++++++++++++++++
8 files changed, 179 insertions(+), 19 deletions(-)
--
2.34.1
Powered by blists - more mailing lists