Jamal Hadi Salim d62b04fca4 net: sched: fix ets qdisc OOB Indexing ... Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] <TASK> [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ? __lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012] ___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ? __memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416] __x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] </TASK> [ 18.888610] ---[ end trace ]--- Fixes: dcc68b4d80 ("net: sch_ets: Add a new Qdisc") Reported-by: Haowei Yan <g1042620637@gmail.com> Suggested-by: Haowei Yan <g1042620637@gmail.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Petr Machata <petrm@nvidia.com> Link: https://patch.msgid.link/20250111145740.74755-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-01-22 19:35:43 -08:00
..
act_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-10-25 09:08:22 +02:00
act_bpf.c	net: Rename mono_delivery_time to tstamp_type for scalabilty	2024-05-23 14:14:23 -07:00
act_connmark.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_csum.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_ct.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
act_ctinfo.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
act_gact.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_gate.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
act_ife.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_meta_mark.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbprio.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
act_mirred.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-02-22 15:29:26 -08:00
act_mpls.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
act_nat.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_pedit.c	net: sched: Annotate struct tc_pedit with __counted_by	2024-02-19 10:58:24 +00:00
act_police.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
act_sample.c	net: sched: act_sample: add action cookie to sample	2024-07-05 17:45:47 -07:00
act_simple.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_skbedit.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
act_skbmod.c	net/sched: act_skbmod: convert comma to semicolon	2024-07-11 17:12:15 -07:00
act_tunnel_key.c	ip_tunnel: convert __be16 tunnel flags to bitmaps	2024-04-01 10:49:28 +01:00
act_vlan.c	tc: adjust network header after 2nd vlan push	2024-08-27 11:37:42 +02:00
cls_api.c	net: sched: refine software bypass handling in tc_run	2025-01-20 09:21:27 +00:00
cls_basic.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_bpf.c	net: sched: refine software bypass handling in tc_run	2025-01-20 09:21:27 +00:00
cls_cgroup.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_flow.c	net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute	2025-01-04 08:49:36 -08:00
cls_flower.c	net: sched: refine software bypass handling in tc_run	2025-01-20 09:21:27 +00:00
cls_fw.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_matchall.c	net: sched: refine software bypass handling in tc_run	2025-01-20 09:21:27 +00:00
cls_route.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
cls_u32.c	net: sched: refine software bypass handling in tc_run	2025-01-20 09:21:27 +00:00
em_canid.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_cmp.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
em_ipset.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
em_ipt.c	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
em_meta.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_nbyte.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_text.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
em_u32.c	net: fill in MODULE_DESCRIPTION()s for net/sched	2024-02-09 14:12:02 -08:00
ematch.c	net_sched: reject TCF_EM_SIMPLE case for complex ematch module	2022-12-19 09:43:18 +00:00
Kconfig	net: sched: Remove NET_ACT_IPT from Kconfig	2024-02-13 11:24:35 +01:00
Makefile	net/sched: Retire ipt action	2024-01-02 12:41:16 +00:00
sch_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-01-21 10:24:33 +01:00
sch_blackhole.c	Revert "net: sched: Pass root lock to Qdisc_ops.enqueue"	2020-07-16 16:48:34 -07:00
sch_cake.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-01-09 16:11:47 -08:00
sch_cbs.c	net/sched: cbs: Fix integer overflow in cbs_set_port_rate()	2024-10-15 18:25:47 -07:00
sch_choke.c	net: sched: fix ordering of qlen adjustment	2024-12-04 12:54:22 +00:00
sch_codel.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_drr.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_etf.c	net_sched: sch_tfs: implement lockless etf_dump()	2024-04-19 11:34:07 +01:00
sch_ets.c	net: sched: fix ets qdisc OOB Indexing	2025-01-22 19:35:43 -08:00
sch_fifo.c	net_sched: sch_fifo: implement lockless __fifo_dump()	2024-04-19 11:34:07 +01:00
sch_fq.c	net_sched: sch_fq: add three drop_reason	2024-12-05 17:39:04 -08:00
sch_fq_codel.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_fq_pie.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_frag.c	net: dst: remove unnecessary input parameter in dst_alloc and dst_init	2023-09-12 11:42:25 +02:00
sch_generic.c	net: sched: calls synchronize_net() only when needed	2025-01-14 10:17:53 +01:00
sch_gred.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_hfsc.c	net_sched: sch_hfsc: implement lockless accesses to q->defcls	2024-04-19 11:34:08 +01:00
sch_hhf.c	net_sched: sch_hhf: implement lockless hhf_dump()	2024-04-19 11:34:08 +01:00
sch_htb.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
sch_ingress.c	bpf: Fix too early release of tcx_entry	2024-07-08 14:07:31 -07:00
sch_mq.c	net: sched: add rcu annotations around qdisc->qdisc_sleeping	2023-06-07 10:25:39 +01:00
sch_mqprio.c	netlink: introduce type-checking attribute iteration	2024-03-29 15:06:02 -07:00
sch_mqprio_lib.c	net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs	2023-11-01 21:49:09 -07:00
sch_mqprio_lib.h	net/sched: mqprio: allow per-TC user input of FP adminStatus	2023-04-13 22:22:10 -07:00
sch_multiq.c	net: sched: sch_multiq: fix possible OOB write in multiq_tune()	2024-06-05 10:50:19 +01:00
sch_netem.c	net/sched: netem: account for backlog updates from child qdisc	2024-12-11 20:26:37 -08:00
sch_pie.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_plug.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_prio.c	net/sched: Add module aliases for cls_,sch_,act_ modules	2024-02-02 10:57:55 -08:00
sch_qfq.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
sch_red.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_sfb.c	net/sched: Add drop reasons for AQM-based qdiscs	2024-12-17 13:27:29 +01:00
sch_sfq.c	net_sched: sch_sfq: don't allow 1 packet limit	2024-12-05 18:02:10 -08:00
sch_skbprio.c	net_sched: sch_skbprio: implement lockless skbprio_dump()	2024-04-19 11:34:08 +01:00
sch_taprio.c	net: convert to nla_get_*_default()	2024-11-11 10:32:06 -08:00
sch_tbf.c	net/sched: tbf: correct backlog statistic for GSO packets	2024-11-30 13:02:43 -08:00
sch_teql.c	net: annotate writes on dev->mtu from ndo_change_mtu()	2024-05-07 16:19:14 -07:00