netdev - Re: [PATCH net] net/sched: sch_qfq: do not free existing class in qfq_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89i+AMSr3oHahFkmDoYDC4DeYyuXVkCTszTe9TQFxh6DLdQ@mail.gmail.com>
Date: Mon, 12 Jan 2026 19:38:30 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Jamal Hadi Salim <jhs@...atatu.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Cong Wang <xiyou.wangcong@...il.com>, Jiri Pirko <jiri@...nulli.us>, netdev@...r.kernel.org, 
	eric.dumazet@...il.com, syzbot+07f3f38f723c335f106d@...kaller.appspotmail.com
Subject: Re: [PATCH net] net/sched: sch_qfq: do not free existing class in qfq_change_class()

On Mon, Jan 12, 2026 at 7:27 PM Jamal Hadi Salim <jhs@...atatu.com> wrote:
>
> On Mon, Jan 12, 2026 at 12:56 PM Eric Dumazet <edumazet@...gle.com> wrote:
> >
> > Fixes qfq_change_class() error case.
> >
> > cl->qdisc and cl should only be freed if a new class and qdisc
> > were allocated, or we risk various UAF.
> >
> > Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
> > Reported-by: syzbot+07f3f38f723c335f106d@...kaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T/#u
> > Signed-off-by: Eric Dumazet <edumazet@...gle.com>
>
> Eric,
> The patch looks correct.  Initially i was scratching my head trying to
> see how you knew it was the same issue. I gues on a UAF even without a
> repro syzbot can tell you exactly where the UAF happened?

Without a repro, I was still able to root-cause the issue to the
unexpected kfree().

syzbot report was sent as-is on the mailing list, I had no more information.

Thanks.

>
> Reviewed-by: Jamal Hadi Salim <jhs@...atatu.com>
>
> cheers,
> jamal
>
> >  net/sched/sch_qfq.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
> > index f4013b547438ffe1bdc8ba519971a1681df4700b..9d59090bbe934ad56ab08a59708aab375aa77cf0 100644
> > --- a/net/sched/sch_qfq.c
> > +++ b/net/sched/sch_qfq.c
> > @@ -529,8 +529,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
> >         return 0;
> >
> >  destroy_class:
> > -       qdisc_put(cl->qdisc);
> > -       kfree(cl);
> > +       if (!existing) {
> > +               qdisc_put(cl->qdisc);
> > +               kfree(cl);
> > +       }
> >         return err;
> >  }
> >
> > --
> > 2.52.0.457.g6b5491de43-goog
> >