[FIPS 8.7 Legacy] net_sched: hfsc: Address reentrant enqueue adding class to eltree twice #510
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… qdisc jira VULN-68294 cve CVE-2025-37890 commit-author Victor Nogueira <[email protected]> commit 141d343 As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that checking for cl->qdisc->q.qlen == 0 guarantees that it hasn't inserted the class in the vttree or eltree (which is not true for the netem duplicate case). This patch checks the n_active class variable to make sure that the code won't insert the class in the vttree or eltree twice, catering for the reentrant case. [1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/ Fixes: 37d9cf1 ("sched: Fix detection of empty queues in child qdiscs") Reported-by: Gerrard Tai <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Signed-off-by: Victor Nogueira <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 141d343) Signed-off-by: Marcin Wcisło <[email protected]>
|
"LC" = "Legacy Compliant". Goes with the "LTS" naming for the "Long Term Support" kernels. Planning to use a similar naming for other FIPSes as well:
Didn't see such naming in other PRs, but also didn't see any other consistent naming for that matter, which means there are probably no hard requirements. Let me know please @PlaidCat if that's ok |
PlaidCat
requested review from
kerneltoast,
PlaidCat,
bmastbergen,
thefossguy-ciq and
shreeya-patel98
We have been using:
|
No, it has been much richer than that, that's the point.
Let me use these tags then:
Why:
Is that ok, @PlaidCat? |
This was referenced Aug 19, 2025
pvts-mat
changed the title
jira VULN-68363 cve CVE-2025-38001 commit-author Pedro Tammela <[email protected]> commit ac9fe7d Savino says: "We are writing to report that this recent patch (141d343) [1] can be bypassed, and a UAF can still occur when HFSC is utilized with NETEM. The patch only checks the cl->cl_nactive field to determine whether it is the first insertion or not [2], but this field is only incremented by init_vf [3]. By using HFSC_RSC (which uses init_ed) [4], it is possible to bypass the check and insert the class twice in the eltree. Under normal conditions, this would lead to an infinite loop in hfsc_dequeue for the reasons we already explained in this report [5]. However, if TBF is added as root qdisc and it is configured with a very low rate, it can be utilized to prevent packets from being dequeued. This behavior can be exploited to perform subsequent insertions in the HFSC eltree and cause a UAF." To fix both the UAF and the infinite loop, with netem as an hfsc child, check explicitly in hfsc_enqueue whether the class is already in the eltree whenever the HFSC_RSC flag is set. [1] https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=141d34391abbb315d68556b7c67ad97885407547 [2] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1572 [3] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L677 [4] https://elixir.bootlin.com/linux/v6.15-rc5/source/net/sched/sch_hfsc.c#L1574 [5] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/T/#u Fixes: 37d9cf1 ("sched: Fix detection of empty queues in child qdiscs") Reported-by: Savino Dicanosa <[email protected]> Reported-by: William Liu <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Tested-by: Victor Nogueira <[email protected]> Signed-off-by: Pedro Tammela <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit ac9fe7d) Signed-off-by: Marcin Wcisło <[email protected]>
pvts-mat
force-pushed
the
fips8l-CVE-2025-37890
branch
from
47dae5f to
80897f5
Compare
|
Changed tags in accordance with #514 (comment) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[FIPS 8.7 Legacy]
CVE-2025-37890
VULN-68294
Problem
https://access.redhat.com/security/cve/CVE-2025-37890
Applicability: yes
The patch relates to the
sch_hfscmodule, enabled with theNET_SCH_HFSCoption. It's set tomin all configs of FIPS 8.7 Legacy:The commit 37d9cf1 marked as introducing the bug was backported to FIPS 8.7 Legacy in f3e1778. The mainline fix 141d343 wasn't backported. For the full picture please refer to the Appendix: Bug timeline
Solution
The same situation as in #490, which see.
kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Coverage
Only the net-related tests were run.
net/forwarding(exceptsch_tbf_prio.sh,ipip_hier_gre_keys.sh,sch_tbf_ets.sh,mirror_gre_vlan_bridge_1q.sh,sch_ets.sh,mirror_gre_bridge_1d_vlan.sh,bridge_igmp.sh,sch_tbf_root.sh,tc_actions.sh),net/mptcp(exceptmptcp_join.sh,simult_flows.sh),net(exceptudpgro_fwd.sh,udpgso_bench.sh,txtimestamp.sh,xfrm_policy.sh,ip_defrag.sh,gro.sh,reuseport_addr_any.sh),netfilter(exceptnft_trans_stress.sh)Reference
kselftests–fips8l–run1.log
kselftests–fips8l–run2.log
Patch
kselftests–fips8l-CVE-2025-37890–run1.log
kselftests–fips8l-CVE-2025-37890–run2.log
Comparison
The tests results for the reference and patch are the same.
Specific tests: skipped
Appendix: Bug timeline
(This is a version of "Appendix: Bug timeline" from #490 augmented with FIPS kernels)
The following table summarizes the timeline of the
net/sched/sch_hfsc.cfile on 9 branches:ciqlts9_4,ciqlts9_2,ciqlts8_6,fips-legacy-8-compliant/4.18.0-425.13.1(asfips8l),fips-8-compliant/4.18.0-553.16.1(asfips8c),fips-9-compliant/5.14.0-284.30.1(asfips9c),kernel-mainline,linux-5.15.y,linux-4.19.y,ordered from the newest to the oldest (roughly).