Patch "net/sched: Prohibit regrafting ingress or clsact Qdiscs" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/sched: Prohibit regrafting ingress or clsact Qdiscs

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-prohibit-regrafting-ingress-or-clsact-qdis.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 960eabc81ccc7abbae19c5c875812c44709bb8ab
Author: Peilin Ye <peilin.ye@xxxxxxxxxxxxx>
Date:   Mon May 29 12:54:26 2023 -0700

    net/sched: Prohibit regrafting ingress or clsact Qdiscs
    
    [ Upstream commit 9de95df5d15baa956c2b70b9e794842e790a8a13 ]
    
    Currently, after creating an ingress (or clsact) Qdisc and grafting it
    under TC_H_INGRESS (TC_H_CLSACT), it is possible to graft it again under
    e.g. a TBF Qdisc:
    
      $ ip link add ifb0 type ifb
      $ tc qdisc add dev ifb0 handle 1: root tbf rate 20kbit buffer 1600 limit 3000
      $ tc qdisc add dev ifb0 clsact
      $ tc qdisc link dev ifb0 handle ffff: parent 1:1
      $ tc qdisc show dev ifb0
      qdisc tbf 1: root refcnt 2 rate 20Kbit burst 1600b lat 560.0ms
      qdisc clsact ffff: parent ffff:fff1 refcnt 2
                                          ^^^^^^^^
    
    clsact's refcount has increased: it is now grafted under both
    TC_H_CLSACT and 1:1.
    
    ingress and clsact Qdiscs should only be used under TC_H_INGRESS
    (TC_H_CLSACT).  Prohibit regrafting them.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Fixes: 1f211a1b929c ("net, sched: add clsact qdisc")
    Tested-by: Pedro Tammela <pctammela@xxxxxxxxxxxx>
    Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    Reviewed-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    Reviewed-by: Vlad Buslov <vladbu@xxxxxxxxxx>
    Signed-off-by: Peilin Ye <peilin.ye@xxxxxxxxxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b665f4ff49a60..b330f1192cf8d 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1589,6 +1589,11 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 					NL_SET_ERR_MSG(extack, "Invalid qdisc name");
 					return -EINVAL;
 				}
+				if (q->flags & TCQ_F_INGRESS) {
+					NL_SET_ERR_MSG(extack,
+						       "Cannot regraft ingress or clsact Qdiscs");
+					return -EINVAL;
+				}
 				if (q == p ||
 				    (p && check_loop(q, p, 0))) {
 					NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");