CVE-2025-38350

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: Always pass notifications when child class becomes empty<br /> <br /> Certain classful qdiscs may invoke their classes&amp;#39; dequeue handler on an<br /> enqueue operation. This may unexpectedly empty the child qdisc and thus<br /> make an in-flight class passive via qlen_notify(). Most qdiscs do not<br /> expect such behaviour at this point in time and may re-activate the<br /> class eventually anyways which will lead to a use-after-free.<br /> <br /> The referenced fix commit attempted to fix this behavior for the HFSC<br /> case by moving the backlog accounting around, though this turned out to<br /> be incomplete since the parent&amp;#39;s parent may run into the issue too.<br /> The following reproducer demonstrates this use-after-free:<br /> <br /> tc qdisc add dev lo root handle 1: drr<br /> tc filter add dev lo parent 1: basic classid 1:1<br /> tc class add dev lo parent 1: classid 1:1 drr<br /> tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1<br /> tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0<br /> tc qdisc add dev lo parent 2:1 handle 3: netem<br /> tc qdisc add dev lo parent 3:1 handle 4: blackhole<br /> <br /> echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888<br /> tc class delete dev lo classid 1:1<br /> echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888<br /> <br /> Since backlog accounting issues leading to a use-after-frees on stale<br /> class pointers is a recurring pattern at this point, this patch takes<br /> a different approach. Instead of trying to fix the accounting, the patch<br /> ensures that qdisc_tree_reduce_backlog always calls qlen_notify when<br /> the child qdisc is empty. This solves the problem because deletion of<br /> qdiscs always involves a call to qdisc_reset() and / or<br /> qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing<br /> the following qdisc_tree_reduce_backlog() to report to the parent. Note<br /> that this may call qlen_notify on passive classes multiple times. This<br /> is not a problem after the recent patch series that made all the<br /> classful qdiscs qlen_notify() handlers idempotent.