[cbr79] Many VULNs 10-23-25 #646
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jira VULN-135014 cve CVE-2022-50020 commit-author Kiselev, Oleg <[email protected]> commit 69cb8e9 upstream-diff This kernel doesn't have the ext4_feature_has_bigalloc helper, so this commit uses the EXT4_HAS_RO_COMPAT_FEATURE macro which does the same thing This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock. Signed-off-by: Oleg Kiselev <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Theodore Ts'o <[email protected]> (cherry picked from commit 69cb8e9) Signed-off-by: Brett Mastbergen <[email protected]>
jira VULN-68349 cve-pre CVE-2025-38000 commit-author Toke Høiland-Jørgensen <[email protected]> commit f6bab19 upstream-diff No changes were made to sch_cbs.c because it doesn't support child qdiscs in this kernel because it lacks "990e35ecba1c cbs: Add support for graft function" Parent qdiscs may dereference the pointer to the enqueued skb after enqueue. However, both CAKE and TBF call consume_skb() on the original skb when splitting GSO packets, leading to a potential use-after-free in the parent. Fix this by avoiding dereferencing the skb pointer after enqueueing to the child. Signed-off-by: Toke Høiland-Jørgensen <[email protected]> Signed-off-by: David S. Miller <[email protected]> (cherry picked from commit f6bab19) Signed-off-by: Brett Mastbergen <[email protected]>
jira VULN-68349 cve CVE-2025-38000 commit-author Cong Wang <[email protected]> commit 3f98113 upstream-diff Minor conflict when applying because the conditional in hfsc_enqueue is slightly different in this version of the kernel. When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek. Fixes: 12d0ad3 ("net/sched/sch_hfsc.c: handle corner cases where head may change invalidating calculated deadline") Reported-by: Mingi Cho <[email protected]> Signed-off-by: Cong Wang <[email protected]> Reviewed-by: Simon Horman <[email protected]> Link: https://patch.msgid.link/[email protected] Reviewed-by: Jamal Hadi Salim <[email protected]> Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit 3f98113) Signed-off-by: Brett Mastbergen <[email protected]>
jira VULN-136681 cve CVE-2025-38350 commit-author Lion Ackermann <[email protected]> commit 103406b Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the child qdisc and thus make an in-flight class passive via qlen_notify(). Most qdiscs do not expect such behaviour at this point in time and may re-activate the class eventually anyways which will lead to a use-after-free. The referenced fix commit attempted to fix this behavior for the HFSC case by moving the backlog accounting around, though this turned out to be incomplete since the parent's parent may run into the issue too. The following reproducer demonstrates this use-after-free: tc qdisc add dev lo root handle 1: drr tc filter add dev lo parent 1: basic classid 1:1 tc class add dev lo parent 1: classid 1:1 drr tc qdisc add dev lo parent 1:1 handle 2: hfsc def 1 tc class add dev lo parent 2: classid 2:1 hfsc rt m1 8 d 1 m2 0 tc qdisc add dev lo parent 2:1 handle 3: netem tc qdisc add dev lo parent 3:1 handle 4: blackhole echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 tc class delete dev lo classid 1:1 echo 1 | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888 Since backlog accounting issues leading to a use-after-frees on stale class pointers is a recurring pattern at this point, this patch takes a different approach. Instead of trying to fix the accounting, the patch ensures that qdisc_tree_reduce_backlog always calls qlen_notify when the child qdisc is empty. This solves the problem because deletion of qdiscs always involves a call to qdisc_reset() and / or qdisc_purge_queue() which ultimately resets its qlen to 0 thus causing the following qdisc_tree_reduce_backlog() to report to the parent. Note that this may call qlen_notify on passive classes multiple times. This is not a problem after the recent patch series that made all the classful qdiscs qlen_notify() handlers idempotent. Fixes: 3f98113 ("sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()") Signed-off-by: Lion Ackermann <[email protected]> Reviewed-by: Jamal Hadi Salim <[email protected]> Acked-by: Cong Wang <[email protected]> Acked-by: Jamal Hadi Salim <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 103406b) Signed-off-by: Brett Mastbergen <[email protected]>
🔍 Upstream Linux Kernel Commit Check
This is an automated message from the kernel commit checker workflow. |
This does not apply as this kernel does not have sch_ets |
shreeya-patel98
approved these changes
Oct 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
There is interdiff output for every commit in this PR (Yay!). So I'll just tell the story of these commits via the interdiff output:
The upstream ext4 commit below is using the ext4_has_feature_bigalloc helper, but that doesn't exist in this old kernel. There are macros that do the same thing, so I used those instead
I picked up the commit below as a prerequisite for CVE-2025-38000. It made the fix apply cleaner and it addresses some potential use-after-free (but it doesn't have its own CVE). There is a diff to upstream because sch_cbs doesn't have child qdisc support in this kernel, so that part of the commit was just left out.
Even with the prerequisite commit there was a conflict in the file below because the conditional in hfsc_enqueue is slightly different in this kernel versus upstream.
if (first && !cl->cl_nactive) {vs.
if (cl->qdisc->q.qlen == 1) {The commit below is a bugfix for the prior commit and is associated with CVE-2025-38350 itself. It cleanly applied, but interdiff did flag some differences in the surrounding context. The function signature is different:
void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)vs
void qdisc_tree_reduce_backlog(struct Qdisc *sch, unsigned int n, unsigned int len)And qdisc lookup is preformed slightly different:
sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid));vs
sch = qdisc_lookup(qdisc_dev(sch), TC_H_MAJ(parentid));Commits
Build Log
Testing
selftest-3.10.0-1160.119.1.el7_9.ciqcbr.9.1.x86_64-1.log
selftest-3.10.0-bmastbergen_ciqcbr7_9_many-vulns-10-23-25-a6a76d7+-1.log