In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget<\/p>\n
hfsc_classify() applies the “filter may only point downwards” level check
\nonly when the filter result carries no bound class. A filter created with
\na flowid gets res.class set once at bind time, so the check never runs for
\nit during classification. hfsc_adjust_levels() can later raise a class’s
\nlevel without revalidating existing bindings, leaving two binds that were
\neach legal at bind time pointing at each other; the classify walk then
\nbounces between two interior classes forever with the qdisc lock held and
\nBH disabled \u2014 a soft lockup from a single packet. The stuck walk trips
\nthe watchdog:<\/p>\n
watchdog: BUG: soft lockup – CPU#3 stuck for 13s! [ping:444]
\n RIP: 0010:u32_classify+0x542\/0x17f0
\n …
\n tcf_classify+0x66\/0xa0
\n hfsc_enqueue+0x166\/0xdf0<\/p>\n
Bound the traversal with a budget of non-descending hops, the only way a
\nconfigured walk can move without descending the class tree once levels
\ndrift after bind time. The budget is cumulative over the whole walk and
\nis deliberately not reset on a descending hop: a chain that alternates a
\ndescent with a lateral hop would return the budget every lap and never
\ntrip. Descending hops never decrement it, so legitimately deep trees are
\nunaffected and a terminating lateral chain still classifies normally.
\nDrop the packet with a rate-limited warning once the budget is exhausted,
\nmirroring the merged HTB fix.<\/p>\n
This is a follow-up to commit 729c4896ab82 (“net\/sched: sch_htb: limit
\nhtb_classify inner-class filter hops”), which bounded the same classify
\nloop on the HTB side but left the HFSC walk unbounded.<\/p>\n
Conditions to recreate the bug:
\n– CONFIG_NET_SCHED, CONFIG_NET_SCH_HFSC, CONFIG_NET_CLS_U32,
\n CONFIG_LOCKUP_DETECTOR.
\n– Build a cycle with two legal-at-bind-time flowid binds and a level
\n drift: class X 1:1 (child of root) with leaf child 1:10; class Y 1:2
\n (sibling of X) with children 1:20 and 1:200; root u32 filter flowid
\n 1:1; filter on X flowid 1:2 (legal when Y is a leaf); after Y’s level
\n rises to 2, filter on Y flowid 1:1 (legal then). Send one packet (ping
\n on the device). Unfixed kernel: classify spins with the qdisc lock
\n held; with softlockup_panic=1 it panics.
\n– Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget<\/p>\n
hfsc_classify() applies the “filter may only point d<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41082","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}