In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_api: Don’t replay RTM_GETCHAIN in tc_ctl_chain().<\/p>\n
If a netlink socket sends RTM_GETCHAIN requests repeatedly
\nwithout recv()ing the responses, tc_ctl_chain() hogs CPU and
\ntriggers Hung Task splat. [0]<\/p>\n
As caught in the stack trace, netlink_attachskb() could confuse
\ntc_ctl_chain() by returning -EAGAIN when the userspace netlink
\nsocket’s receive buffer is full.<\/p>\n
The replay: label exists since commit 32a4f5ecd738 (“net: sched:
\nintroduce chain object to uapi”) but was not used initially.<\/p>\n
Since commit 9f407f1768d3 (“net: sched: introduce chain templates”),
\nthe label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()
\nmay release RTNL to call request_module().<\/p>\n
However, the replay logic is unnecessary for RTM_GETCHAIN.<\/p>\n
Let’s apply the replay logic only for RTM_NEWCHAIN.<\/p>\n
[0]:
\nINFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.
\ntask:repro state:R running task stack:14096 pid:1022 tgid:1014 ppid:961 task_flags:0x400040 flags:0x00080000
\nCall Trace:<\/p>\n
? clockevents_program_event (kernel\/time\/clockevents.c:372)
\n ? pskb_expand_head (net\/core\/skbuff.c:615)
\n ? skb_release_data (net\/core\/skbuff.c:1122)
\n ? netlink_attachskb (.\/include\/linux\/skbuff.h:1323 .\/include\/linux\/skbuff.h:1332 net\/netlink\/af_netlink.c:1232)
\n ? __netlink_lookup (.\/include\/linux\/rcupdate.h:882 .\/include\/linux\/rhashtable.h:711 net\/netlink\/af_netlink.c:499)
\n ? tc_chain_notify (net\/sched\/cls_api.c:3045)
\n ? tc_chain_notify (.\/include\/linux\/skbuff.h:1384 net\/sched\/cls_api.c:3041)
\n ? netlink_unicast (net\/netlink\/af_netlink.c:1335)
\n ? rtnl_unicast (.\/include\/net\/netlink.h:1198 net\/core\/rtnetlink.c:985)
\n ? tc_ctl_chain (net\/sched\/cls_api.c:3242)
\n ? rtnetlink_rcv_msg (net\/core\/rtnetlink.c:7146)
\n ? netlink_unicast (net\/netlink\/af_netlink.c:1354)
\n ? __pfx_rtnetlink_rcv_msg (net\/core\/rtnetlink.c:7177)
\n ? netlink_rcv_skb (net\/netlink\/af_netlink.c:2556)
\n ? netlink_unicast (net\/netlink\/af_netlink.c:1319)
\n ? netlink_sendmsg (net\/netlink\/af_netlink.c:1900)
\n ? __sock_sendmsg (net\/socket.c:800)
\n ? __sys_sendto (net\/socket.c:2281)
\n ? __x64_sys_sendto (net\/socket.c:2288 net\/socket.c:2284 net\/socket.c:2284)
\n ? do_syscall_64 (arch\/x86\/entry\/syscall_64.c:61 arch\/x86\/entry\/syscall_64.c:84)
\n ? entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_api: Don’t replay RTM_GETCHAIN in tc_ctl_chain().<\/p>\n
If a netlink socket sends RTM_GETCHAIN requests repeatedly
\nwithou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29114","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}