diff options
| author | Stephen Hemminger <[email protected]> | 2024-09-01 11:16:07 -0700 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2024-09-03 11:44:23 -0700 |
| commit | 3b3a2a9c6349e25a025d2330f479bc33a6ccb54a (patch) | |
| tree | 1472a89d1a04fe7e1daa0e866bff50fc572a4cb7 /tools/testing/selftests/bpf/progs/test_autoload.c | |
| parent | bab8eb0dd4cb995caa4a0529d5655531c2ec5e8e (diff) | |
sch/netem: fix use after free in netem_dequeue
If netem_dequeue() enqueues packet to inner qdisc and that qdisc
returns __NET_XMIT_STOLEN. The packet is dropped but
qdisc_tree_reduce_backlog() is not called to update the parent's
q.qlen, leading to the similar use-after-free as Commit
e04991a48dbaf382 ("netem: fix return value if duplicate enqueue
fails")
Commands to trigger KASAN UaF:
ip link add type dummy
ip link set lo up
ip link set dummy0 up
tc qdisc add dev lo parent root handle 1: drr
tc filter add dev lo parent 1: basic classid 1:1
tc class add dev lo classid 1:1 drr
tc qdisc add dev lo parent 1:1 handle 2: netem
tc qdisc add dev lo parent 2: handle 3: drr
tc filter add dev lo parent 3: basic classid 3:1 action mirred egress
redirect dev dummy0
tc class add dev lo classid 3:1 drr
ping -c1 -W0.01 localhost # Trigger bug
tc class del dev lo classid 1:1
tc class add dev lo classid 1:1 drr
ping -c1 -W0.01 localhost # UaF
Fixes: 50612537e9ab ("netem: fix classful handling")
Reported-by: Budimir Markovic <[email protected]>
Signed-off-by: Stephen Hemminger <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'tools/testing/selftests/bpf/progs/test_autoload.c')
0 files changed, 0 insertions, 0 deletions