CVE-2025-38457
net/sched: Abort __tc_modify_qdisc if parent class does not exist
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
net/sched: Abort __tc_modify_qdisc if parent class does not exist
In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/
Reserved 2025-04-16 | Published 2025-07-25 | Updated 2025-07-25 | Assigner Linuxgit.kernel.org/...c/923a276c74e25073ae391e930792ac86a9f77f1e
git.kernel.org/...c/90436e72c9622c2f70389070088325a3232d339f
git.kernel.org/...c/25452638f133ac19d75af3f928327d8016952c8e
git.kernel.org/...c/23c165dde88eac405eebb59051ea1fe139a45803
git.kernel.org/...c/4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af
git.kernel.org/...c/8ecd651ef24ab50123692a4e3e25db93cb11602a
git.kernel.org/...c/e28a383d6485c3bb51dc5953552f76c4dea33eea
git.kernel.org/...c/ffdde7bf5a439aaa1955ebd581f5c64ab1533963
Support options
