Hi Budimir, Greg, Sorry to bother again with this patch but it fixes the CVE-2023-4623 and has also been backported to all stable kernels other than v4.14 so I wonder is there a reason to skip v4.14? I removed the NL_SET_ERR_MSG call because extack is not added to hfsc_change_class in 4.14 and hope to get some confirmation if it can be applied to 4.14 tree. Thanks, Shaoying < On 2023-09-20, 10:52 AM, "Xu, Shaoying" <shaoyi@xxxxxxxxxx <mailto:shaoyi@xxxxxxxxxx>> wrote: < < < From: Budimir Markovic <markovicbudimir@xxxxxxxxx <mailto:markovicbudimir@xxxxxxxxx>> < < < [ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ] < < < HFSC assumes that inner classes have an fsc curve, but it is currently < possible for classes without an fsc curve to become parents. This leads < to bugs including a use-after-free. < < < Don't allow non-root classes without HFSC_FSC to become parents. < < < Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") < Reported-by: Budimir Markovic <markovicbudimir@xxxxxxxxx <mailto:markovicbudimir@xxxxxxxxx>> < Signed-off-by: Budimir Markovic <markovicbudimir@xxxxxxxxx <mailto:markovicbudimir@xxxxxxxxx>> < Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx <mailto:jhs@xxxxxxxxxxxx>> < Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@xxxxxxxxx <mailto:20230824084905.422-1-markovicbudimir@xxxxxxxxx> < Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx <mailto:kuba@xxxxxxxxxx>> < [ v4.14: Delete NL_SET_ERR_MSG because extack is not added to hfsc_change_class ] < Cc: <stable@xxxxxxxxxxxxxxx <mailto:stable@xxxxxxxxxxxxxxx>> # 4.14 < Signed-off-by: Shaoying Xu <shaoyi@xxxxxxxxxx <mailto:shaoyi@xxxxxxxxxx>> < --- < net/sched/sch_hfsc.c | 2 ++ < 1 file changed, 2 insertions(+) < < < diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c < index 3f88b75488b0..3a43abe4d9c4 100644 < --- a/net/sched/sch_hfsc.c < +++ b/net/sched/sch_hfsc.c < @@ -1020,6 +1020,8 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid, < if (parent == NULL) < return -ENOENT; < } < + if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) < + return -EINVAL; < < < if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0) < return -EINVAL; < -- < 2.40.1 <
