In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_api: reclaim an empty proto on the error path<\/p>\n
Two racing tc filter add requests on the same chain\/prio of an
\nunlocked classifier both run change() on the shared proto and both
\ncan fail: the winner’s tcf_chain_tp_delete_empty() attempt gives up
\nbecause the loser’s handle is still in the idr, and the loser’s
\nerror path drops only its own reference without a second reclamation
\nattempt. The empty proto stays linked in the chain, holding the
\nchain reference, a block reference and the classifier module
\nreference until the chain or block is torn down.<\/p>\n
Reclaim the proto on the error path of any failed request that holds
\na proto reference. The reclamation is emptiness-gated:
\ntcf_chain_tp_delete_empty() unlinks the proto only when
\ndelete_empty() admits it is empty, so a live shared proto is never
\nunlinked. A proto the request created is reclaimed unconditionally –
\nit is the only owner, so marking it for deletion is safe even without
\na delete_empty callback. Classifiers without one (the check marks the
\nproto unconditionally) are rtnl-serialized, so the raced window this
\nguard closes cannot arise for them.<\/p>\n
This is a follow-up to commit d4e359b3608a (“net\/sched: cls_api: fix
\nteardown of an adopted proto on insert-race loss”), which stopped the
\nloser of the insert race from unlinking the winner’s live proto but
\nleft the empty-proto residual in place.<\/p>\n
Conditions to recreate:
\n– CONFIG_NET_CLS_FLOWER=y; veth pair
\n– tc qdisc add dev veth0 ingress
\n– two concurrent `tc filter add dev veth0 ingress protocol ip pref 1
\n flower skip_sw … action drop` (both fail in fl_hw_replace_filter
\n after publishing their handle in the idr); repeat in a loop
\n– an empty flower tp stays linked after both requests fail; visible
\n as a bare `filter protocol ip pref 1 flower chain 0` header in
\n `tc filter show` with no filter entries
\n– CAP_NET_ADMIN (namespace-local via unshare -Urn suffices)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_api: reclaim an empty proto on the error path<\/p>\n
Two racing tc filter add requests on the same chain\/prio of an
\nunlock<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41283","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}