This is a note to let you know that I've just added the patch titled net/sched: sch_hfsc: Ensure inner classes have fsc curve to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-sched-sch_hfsc-ensure-inner-classes-have-fsc-curve.patch and it can be found in the queue-4.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From b3d26c5702c7d6c45456326e56d2ccf3f103e60f Mon Sep 17 00:00:00 2001 From: Budimir Markovic <markovicbudimir@xxxxxxxxx> Date: Thu, 24 Aug 2023 01:49:05 -0700 Subject: net/sched: sch_hfsc: Ensure inner classes have fsc curve From: Budimir Markovic <markovicbudimir@xxxxxxxxx> commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f upstream. HFSC assumes that inner classes have an fsc curve, but it is currently possible for classes without an fsc curve to become parents. This leads to bugs including a use-after-free. Don't allow non-root classes without HFSC_FSC to become parents. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Budimir Markovic <markovicbudimir@xxxxxxxxx> Signed-off-by: Budimir Markovic <markovicbudimir@xxxxxxxxx> Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx> Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@xxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> [ v4.14: Delete NL_SET_ERR_MSG because extack is not added to hfsc_change_class ] Signed-off-by: Shaoying Xu <shaoyi@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sched/sch_hfsc.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -1020,6 +1020,8 @@ hfsc_change_class(struct Qdisc *sch, u32 if (parent == NULL) return -ENOENT; } + if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) + return -EINVAL; if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) return -EINVAL; Patches currently in stable-queue which might be from markovicbudimir@xxxxxxxxx are queue-4.14/net-sched-sch_hfsc-ensure-inner-classes-have-fsc-curve.patch