netdev - Re: [PATCH net] net/sched: sch_qfq: do not free existing class in qfq_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM0EoMkg5W0hGyZo7TMxj61mGDtdZDcTWjJQ1ZMx9oAxM4+=_g@mail.gmail.com>
Date: Mon, 12 Jan 2026 13:26:50 -0500
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>, netdev@...r.kernel.org, 
	eric.dumazet@...il.com, syzbot+07f3f38f723c335f106d@...kaller.appspotmail.com
Subject: Re: [PATCH net] net/sched: sch_qfq: do not free existing class in qfq_change_class()

On Mon, Jan 12, 2026 at 12:56 PM Eric Dumazet <edumazet@...gle.com> wrote:
>
> Fixes qfq_change_class() error case.
>
> cl->qdisc and cl should only be freed if a new class and qdisc
> were allocated, or we risk various UAF.
>
> Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
> Reported-by: syzbot+07f3f38f723c335f106d@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Eric,
The patch looks correct.  Initially i was scratching my head trying to
see how you knew it was the same issue. I gues on a UAF even without a
repro syzbot can tell you exactly where the UAF happened?

Reviewed-by: Jamal Hadi Salim <jhs@...atatu.com>

cheers,
jamal

>  net/sched/sch_qfq.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
> index f4013b547438ffe1bdc8ba519971a1681df4700b..9d59090bbe934ad56ab08a59708aab375aa77cf0 100644
> --- a/net/sched/sch_qfq.c
> +++ b/net/sched/sch_qfq.c
> @@ -529,8 +529,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
>         return 0;
>
>  destroy_class:
> -       qdisc_put(cl->qdisc);
> -       kfree(cl);
> +       if (!existing) {
> +               qdisc_put(cl->qdisc);
> +               kfree(cl);
> +       }
>         return err;
>  }
>
> --
> 2.52.0.457.g6b5491de43-goog
>