From: Johannes Berg johannes.berg@intel.com
mainline inclusion from mainline-v6.10-rc4 commit 44180feaccf266d9b0b28cc4ceaac019817deb5c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9L5IO CVE: CVE-2024-27010
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
-------------------------------------------
When the noop_qdisc owner isn't initialized, then it will be 0, so packets will erroneously be regarded as having been subject to recursion as long as only CPU 0 queues them. For non-SMP, that's all packets, of course. This causes a change in what's reported to userspace, normally noop_qdisc would drop packets silently, but with this change the syscall returns -ENOBUFS if RECVERR is also set on the socket.
Fix this by initializing the owner field to -1, just like it would be for dynamically allocated qdiscs by qdisc_alloc().
Fixes: 0f022d32c3ec ("net/sched: Fix mirred deadlock on device recursion") Signed-off-by: Johannes Berg johannes.berg@intel.com Reviewed-by: Eric Dumazet edumazet@google.com Link: https://lore.kernel.org/r/20240607175340.786bfb938803.I493bf8422e36be4454c08... Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com --- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index a3e9dd348500..ec55f306ab2a 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -592,6 +592,7 @@ struct Qdisc noop_qdisc = { .qlen = 0, .lock = __SPIN_LOCK_UNLOCKED(noop_qdisc.skb_bad_txq.lock), }, + .owner = -1, }; EXPORT_SYMBOL(noop_qdisc);