diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2025-03-06 15:23:54 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-03-22 12:50:39 -0700 |
| commit | 78533c4a29ac3aeddce4b481770beaaa4f3bfb67 (patch) | |
| tree | 8d0c9a9d51611fe09f8c231ac2b1b010866fba50 /net | |
| parent | 1bd2a8bb1ccb85378a0d2dde0318d7b237c8cbb7 (diff) | |
| download | linux-78533c4a29ac3aeddce4b481770beaaa4f3bfb67.tar.gz linux-78533c4a29ac3aeddce4b481770beaaa4f3bfb67.tar.bz2 linux-78533c4a29ac3aeddce4b481770beaaa4f3bfb67.zip | |
net_sched: Prevent creation of classes with TC_H_ROOT
[ Upstream commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e ]
The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
condition when traversing up the qdisc tree to update parent backlog
counters. However, if a class is created with classid TC_H_ROOT, the
traversal terminates prematurely at this class instead of reaching the
actual root qdisc, causing parent statistics to be incorrectly maintained.
In case of DRR, this could lead to a crash as reported by Mingi Cho.
Prevent the creation of any Qdisc class with classid TC_H_ROOT
(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
Reported-by: Mingi Cho <mincho@theori.io>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Fixes: 066a3b5b2346 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop")
Link: https://patch.msgid.link/20250306232355.93864-2-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_api.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 7cddaa6321c7..df89790c459a 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -2197,6 +2197,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, return -EOPNOTSUPP; } + /* Prevent creation of traffic classes with classid TC_H_ROOT */ + if (clid == TC_H_ROOT) { + NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT"); + return -EINVAL; + } + new_cl = cl; err = -EOPNOTSUPP; if (cops->change) |