CVE-2024-57996

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net_sched: sch_sfq: don&amp;#39;t allow 1 packet limit<br /> <br /> The current implementation does not work correctly with a limit of<br /> 1. iproute2 actually checks for this and this patch adds the check in<br /> kernel as well.<br /> <br /> This fixes the following syzkaller reported crash:<br /> <br /> UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6<br /> index 65535 is out of range for type &amp;#39;struct sfq_head[128]&amp;#39;<br /> CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024<br /> Call Trace:<br /> __dump_stack lib/dump_stack.c:79 [inline]<br /> dump_stack+0x125/0x19f lib/dump_stack.c:120<br /> ubsan_epilogue lib/ubsan.c:148 [inline]<br /> __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347<br /> sfq_link net/sched/sch_sfq.c:210 [inline]<br /> sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238<br /> sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500<br /> sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525<br /> qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026<br /> tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319<br /> qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026<br /> dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296<br /> netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]<br /> dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362<br /> __dev_close_many+0x214/0x350 net/core/dev.c:1468<br /> dev_close_many+0x207/0x510 net/core/dev.c:1506<br /> unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738<br /> unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695<br /> unregister_netdevice include/linux/netdevice.h:2893 [inline]<br /> __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689<br /> tun_detach drivers/net/tun.c:705 [inline]<br /> tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640<br /> __fput+0x203/0x840 fs/file_table.c:280<br /> task_work_run+0x129/0x1b0 kernel/task_work.c:185<br /> exit_task_work include/linux/task_work.h:33 [inline]<br /> do_exit+0x5ce/0x2200 kernel/exit.c:931<br /> do_group_exit+0x144/0x310 kernel/exit.c:1046<br /> __do_sys_exit_group kernel/exit.c:1057 [inline]<br /> __se_sys_exit_group kernel/exit.c:1055 [inline]<br /> __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055<br /> do_syscall_64+0x6c/0xd0<br /> entry_SYSCALL_64_after_hwframe+0x61/0xcb<br /> RIP: 0033:0x7fe5e7b52479<br /> Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.<br /> RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7<br /> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479<br /> RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000<br /> RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014<br /> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0<br /> R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270<br /> <br /> The crash can be also be reproduced with the following (with a tc<br /> recompiled to allow for sfq limits of 1):<br /> <br /> tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s<br /> ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1<br /> ifconfig dummy0 up<br /> ping -I dummy0 -f -c2 -W0.1 8.8.8.8<br /> sleep 1<br /> <br /> Scenario that triggers the crash:<br /> <br /> * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1<br /> <br /> * TBF dequeues: it peeks from SFQ which moves the packet to the<br /> gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so<br /> it schedules itself for later.<br /> <br /> * the second packet is sent and TBF tries to queues it to SFQ. qdisc<br /> qlen is now 2 and because the SFQ limit is 1 the packet is dropped<br /> by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,<br /> however q-&gt;tail is not NULL.<br /> <br /> At this point, assuming no more packets are queued, when sch_dequeue<br /> runs again it will decrement the qlen for the current empty slot<br /> causing an underflow and the subsequent out of bounds access.