DuDu371/linux-rockchip
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-rockchip/net/sched
History
Exact
Dmitry Antipov fe371f0840 net: sched: fix use-after-free in taprio_change() 
[ Upstream commit f504465970aebb2467da548f7c1efbbf36d0f44b ]

In 'taprio_change()', 'admin' pointer may become dangling due to sched
switch / removal caused by 'advance_sched()', and critical section
protected by 'q->current_entry_lock' is too small to prevent from such
a scenario (which causes use-after-free detected by KASAN). Fix this
by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update
'admin' immediately before an attempt to schedule freeing.

Fixes: a3d43c0d56 ("taprio: Add support adding an admin schedule")
Reported-by: syzbot+b65e0af58423fc8a73aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b65e0af58423fc8a73aa
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20241018051339.418890-1-dmantipov@yandex.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-01 01:56:05 +01:00
..
act_api.c net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers 2024-11-01 01:56:04 +01:00
act_bpf.c
act_connmark.c
act_csum.c
act_ct.c sched: act_ct: take care of padding in struct zones_ht_key 2024-08-11 12:35:56 +02:00
act_ctinfo.c
act_gact.c
act_gate.c
act_ife.c
act_ipt.c net/sched: act_ipt: add sanity checks on skb before calling target 2023-07-19 16:22:01 +02:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c
act_mpls.c
act_nat.c
act_pedit.c net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX 2023-07-19 16:22:05 +02:00
act_police.c net: sched: act_police: fix sparse errors in tcf_police_dump() 2023-06-14 11:15:21 +02:00
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c net/sched: act_skbmod: prevent kernel-infoleak 2024-04-10 16:28:26 +02:00
act_tunnel_key.c
act_vlan.c
cls_api.c net/sched: cls_api: Fix lockup on flushing explicitly created chain 2023-06-21 16:01:01 +02:00
cls_basic.c
cls_bpf.c net: sched: cls_bpf: Undo tcf_bind_filter in case of an error 2023-07-27 08:50:41 +02:00
cls_cgroup.c
cls_flow.c
cls_flower.c net/sched: flower: Ensure both minimum and maximum ports are specified 2023-07-23 13:49:26 +02:00
cls_fw.c net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 12:08:15 +02:00
cls_matchall.c net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms 2023-07-27 08:50:41 +02:00
cls_route.c net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free 2023-08-11 12:08:16 +02:00
cls_u32.c net: sched: cls_u32: Fix allocation size in u32_init() 2023-11-08 14:10:57 +01:00
em_canid.c
em_cmp.c
em_ipset.c
em_ipt.c
em_meta.c net: annotate data-races around sk->sk_lingertime 2023-09-13 09:42:33 +02:00
em_nbyte.c
em_text.c net: sched: em_text: fix possible memory leak in em_text_destroy() 2024-01-10 17:10:23 +01:00
em_u32.c
ematch.c
Kconfig net/sched: Retire dsmark qdisc 2024-03-01 13:26:24 +01:00
Makefile net/sched: Retire dsmark qdisc 2024-03-01 13:26:24 +01:00
sch_api.c net/sched: accept TCA_STAB only for root qdisc 2024-10-17 15:22:22 +02:00
sch_blackhole.c
sch_cake.c sched: sch_cake: fix bulk flow accounting logic for host fairness 2024-09-12 11:10:18 +02:00
sch_cbs.c
sch_choke.c
sch_codel.c
sch_drr.c
sch_etf.c
sch_ets.c
sch_fifo.c
sch_fq.c
sch_fq_codel.c
sch_fq_pie.c net/sched: fq_pie: avoid stalls in fq_pie_timer() 2023-09-19 12:28:00 +02:00
sch_frag.c
sch_generic.c net: fix races in netdev_tx_sent_queue()/dev_watchdog() 2024-11-01 01:56:04 +01:00
sch_gred.c
sch_hfsc.c net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve 2023-10-25 12:03:07 +02:00
sch_hhf.c
sch_htb.c net/sched: fix false lockdep warning on qdisc root lock 2024-06-27 13:46:15 +02:00
sch_ingress.c net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs 2023-06-09 10:34:03 +02:00
sch_mq.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_mqprio.c net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 2023-08-03 10:24:02 +02:00
sch_multiq.c net: sched: sch_multiq: fix possible OOB write in multiq_tune() 2024-06-21 14:35:33 +02:00
sch_netem.c sch/netem: fix use after free in netem_dequeue 2024-09-12 11:10:16 +02:00
sch_pie.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_plug.c net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-19 12:28:02 +02:00
sch_prio.c
sch_qfq.c net: sched: sch_qfq: Fix UAF in qfq_dequeue() 2023-09-19 12:28:02 +02:00
sch_red.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_sfb.c
sch_sfq.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00
sch_skbprio.c
sch_taprio.c net: sched: fix use-after-free in taprio_change() 2024-11-01 01:56:05 +01:00
sch_tbf.c
sch_teql.c net: sched: add rcu annotations around qdisc->qdisc_sleeping 2023-06-14 11:15:21 +02:00