From 84eda7845563ee9c0cc215fe9d0a3c67cb4903fd Mon Sep 17 00:00:00 2001
From: Ryan Sullivan <rysulliv@redhat.com>
Date: Thu, 1 Feb 2024 14:36:30 -0500
Subject: [KPATCH CVE-2023-4921] kpatch fixes for CVE-2023-4921
Kernels:
3.10.0-1160.95.1.el7
3.10.0-1160.99.1.el7
3.10.0-1160.102.1.el7
3.10.0-1160.105.1.el7
3.10.0-1160.108.1.el7
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/67
Approved-by: Joe Lawrence (@joe.lawrence)
Changes since last build:
[x86_64]:
igb_main.o: changed function: igb_configure
l2cap_core.o: changed function: l2cap_chan_hold
l2cap_core.o: changed function: l2cap_conn_get
l2cap_core.o: changed function: l2cap_global_chan_by_psm
l2cap_core.o: changed function: l2cap_recv_frame
l2cap_core.o: new function: klp_l2cap_le_sig_cmd
sch_atm.o: changed function: atm_tc_peek
sch_atm.o: changed function: sch_atm_dequeue
sch_drr.o: changed function: drr_dequeue
sch_dsmark.o: changed function: dsmark_peek
sch_hfsc.o: changed function: hfsc_enqueue
sch_hfsc.o: changed function: qdisc_peek_len
sch_multiq.o: changed function: multiq_peek
sch_prio.o: changed function: prio_peek
sch_qfq.o: changed function: qfq_dequeue
sch_qfq.o: changed function: qfq_enqueue
sch_red.o: changed function: red_peek
sch_sfb.o: changed function: sfb_peek
sch_tbf.o: changed function: tbf_dequeue
[ppc64le]:
l2cap_core.o: changed function: __l2cap_chan_add
l2cap_core.o: changed function: __l2cap_physical_cfm
l2cap_core.o: changed function: __set_monitor_timer
l2cap_core.o: changed function: __set_retrans_timer.part.24
l2cap_core.o: changed function: l2cap_ack_timeout
l2cap_core.o: changed function: l2cap_build_conf_req
l2cap_core.o: changed function: l2cap_chan_busy
l2cap_core.o: changed function: l2cap_chan_close
l2cap_core.o: changed function: l2cap_chan_connect
l2cap_core.o: changed function: l2cap_chan_del
l2cap_core.o: changed function: l2cap_chan_hold
l2cap_core.o: changed function: l2cap_chan_put
l2cap_core.o: changed function: l2cap_chan_send
l2cap_core.o: changed function: l2cap_chan_timeout
l2cap_core.o: changed function: l2cap_conn_add.part.28
l2cap_core.o: changed function: l2cap_conn_del
l2cap_core.o: changed function: l2cap_conn_start
l2cap_core.o: changed function: l2cap_connect
l2cap_core.o: changed function: l2cap_connect_cfm
l2cap_core.o: changed function: l2cap_connect_create_rsp
l2cap_core.o: changed function: l2cap_data_channel
l2cap_core.o: changed function: l2cap_disconn_cfm
l2cap_core.o: changed function: l2cap_do_create
l2cap_core.o: changed function: l2cap_do_start
l2cap_core.o: changed function: l2cap_ertm_resend
l2cap_core.o: changed function: l2cap_ertm_send
l2cap_core.o: changed function: l2cap_global_fixed_chan
l2cap_core.o: changed function: l2cap_handle_rej
l2cap_core.o: changed function: l2cap_handle_srej
l2cap_core.o: changed function: l2cap_logical_cfm
l2cap_core.o: changed function: l2cap_monitor_timeout
l2cap_core.o: changed function: l2cap_move_done
l2cap_core.o: changed function: l2cap_move_setup
l2cap_core.o: changed function: l2cap_parse_conf_rsp.constprop.36
l2cap_core.o: changed function: l2cap_pass_to_tx
l2cap_core.o: changed function: l2cap_process_reqseq
l2cap_core.o: changed function: l2cap_recv_frame
l2cap_core.o: changed function: l2cap_retrans_timeout
l2cap_core.o: changed function: l2cap_retransmit_all
l2cap_core.o: changed function: l2cap_rx
l2cap_core.o: changed function: l2cap_rx_state_recv
l2cap_core.o: changed function: l2cap_security_cfm
l2cap_core.o: changed function: l2cap_send_ack
l2cap_core.o: changed function: l2cap_send_efs_conf_rsp
l2cap_core.o: changed function: l2cap_send_i_or_rr_or_rnr
l2cap_core.o: changed function: l2cap_send_move_chan_cfm
l2cap_core.o: changed function: l2cap_send_move_chan_cfm_icid
l2cap_core.o: changed function: l2cap_send_move_chan_req
l2cap_core.o: changed function: l2cap_send_rr_or_rnr
l2cap_core.o: changed function: l2cap_send_sframe
l2cap_core.o: changed function: l2cap_send_srej
l2cap_core.o: changed function: l2cap_send_srej_tail
l2cap_core.o: changed function: l2cap_start_connection
l2cap_core.o: new function: l2cap_connect_req
sch_atm.o: changed function: atm_tc_bind_filter
sch_atm.o: changed function: atm_tc_change
sch_atm.o: changed function: atm_tc_delete
sch_atm.o: changed function: atm_tc_destroy
sch_atm.o: changed function: atm_tc_enqueue
sch_atm.o: changed function: atm_tc_find
sch_atm.o: changed function: atm_tc_graft
sch_atm.o: changed function: atm_tc_leaf
sch_atm.o: changed function: atm_tc_peek
sch_atm.o: changed function: atm_tc_put
sch_atm.o: changed function: atm_tc_reset
sch_atm.o: changed function: atm_tc_tcf_block
sch_atm.o: changed function: sch_atm_dequeue
sch_drr.o: changed function: drr_dequeue
sch_dsmark.o: changed function: dsmark_bind_filter
sch_dsmark.o: changed function: dsmark_change
sch_dsmark.o: changed function: dsmark_destroy
sch_dsmark.o: changed function: dsmark_dump_class
sch_dsmark.o: changed function: dsmark_init
sch_dsmark.o: changed function: dsmark_peek
sch_dsmark.o: changed function: dsmark_reset
sch_hfsc.o: changed function: hfsc_change_class
sch_hfsc.o: changed function: hfsc_dequeue
sch_hfsc.o: changed function: hfsc_enqueue
sch_multiq.o: changed function: multiq_peek
sch_prio.o: changed function: prio_peek
sch_qfq.o: changed function: qfq_dequeue
sch_qfq.o: changed function: qfq_enqueue
sch_red.o: changed function: red_peek
sch_sfb.o: changed function: sfb_peek
sch_tbf.o: changed function: tbf_dequeue
---------------------------
Modifications:
- redirected to qdisc_peek_dequeued() by modifying functions that
called '->peek(qdisc)' to call klp_cve_2023_4921_peek() rather than by
modifying plug_qdisc_ops
- don't remove existing WARN_ONCE instances to avoid kpatch-build
"unreconcilable difference" error in .data.once section
commit faf95907a10c29861882d7885b6e04ebe20057c8
Author: Davide Caratti <dcaratti@redhat.com>
Date: Fri Oct 27 17:22:42 2023 +0200
net: sched: sch_qfq: Fix UAF in qfq_dequeue()
JIRA: https://issues.redhat.com/browse/RHEL-14397
CVE: CVE-2023-4921
Upstream Status: net.git commit 8fc134fee27f2263988ae38920bc03da416b03d8
commit 8fc134fee27f2263988ae38920bc03da416b03d8
Author: valis <sec@valis.email>
Date: Fri Sep 1 12:22:37 2023 -0400
net: sched: sch_qfq: Fix UAF in qfq_dequeue()
When the plug qdisc is used as a class of the qfq qdisc it could trigger a
UAF. This issue can be reproduced with following commands:
tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1
and boom:
[ 285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0
[ 285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144
[ 285.355903]
[ 285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4
[ 285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[ 285.358376] Call Trace:
[ 285.358773] <IRQ>
[ 285.359109] dump_stack_lvl+0x44/0x60
[ 285.359708] print_address_description.constprop.0+0x2c/0x3c0
[ 285.360611] kasan_report+0x10c/0x120
[ 285.361195] ? qfq_dequeue+0xa7/0x7f0
[ 285.361780] qfq_dequeue+0xa7/0x7f0
[ 285.362342] __qdisc_run+0xf1/0x970
[ 285.362903] net_tx_action+0x28e/0x460
[ 285.363502] __do_softirq+0x11b/0x3de
[ 285.364097] do_softirq.part.0+0x72/0x90
[ 285.364721] </IRQ>
[ 285.365072] <TASK>
[ 285.365422] __local_bh_enable_ip+0x77/0x90
[ 285.366079] __dev_queue_xmit+0x95f/0x1550
[ 285.366732] ? __pfx_csum_and_copy_from_iter+0x10/0x10
[ 285.367526] ? __pfx___dev_queue_xmit+0x10/0x10
[ 285.368259] ? __build_skb_around+0x129/0x190
[ 285.368960] ? ip_generic_getfrag+0x12c/0x170
[ 285.369653] ? __pfx_ip_generic_getfrag+0x10/0x10
[ 285.370390] ? csum_partial+0x8/0x20
[ 285.370961] ? raw_getfrag+0xe5/0x140
[ 285.371559] ip_finish_output2+0x539/0xa40
[ 285.372222] ? __pfx_ip_finish_output2+0x10/0x10
[ 285.372954] ip_output+0x113/0x1e0
[ 285.373512] ? __pfx_ip_output+0x10/0x10
[ 285.374130] ? icmp_out_count+0x49/0x60
[ 285.374739] ? __pfx_ip_finish_output+0x10/0x10
[ 285.375457] ip_push_pending_frames+0xf3/0x100
[ 285.376173] raw_sendmsg+0xef5/0x12d0
[ 285.376760] ? do_syscall_64+0x40/0x90
[ 285.377359] ? __static_call_text_end+0x136578/0x136578
[ 285.378173] ? do_syscall_64+0x40/0x90
[ 285.378772] ? kasan_enable_current+0x11/0x20
[ 285.379469] ? __pfx_raw_sendmsg+0x10/0x10
[ 285.380137] ? __sock_create+0x13e/0x270
[ 285.380673] ? __sys_socket+0xf3/0x180
[ 285.381174] ? __x64_sys_socket+0x3d/0x50
[ 285.381725] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.382425] ? __rcu_read_unlock+0x48/0x70
[ 285.382975] ? ip4_datagram_release_cb+0xd8/0x380
[ 285.383608] ? __pfx_ip4_datagram_release_cb+0x10/0x10
[ 285.384295] ? preempt_count_sub+0x14/0xc0
[ 285.384844] ? __list_del_entry_valid+0x76/0x140
[ 285.385467] ? _raw_spin_lock_bh+0x87/0xe0
[ 285.386014] ? __pfx__raw_spin_lock_bh+0x10/0x10
[ 285.386645] ? release_sock+0xa0/0xd0
[ 285.387148] ? preempt_count_sub+0x14/0xc0
[ 285.387712] ? freeze_secondary_cpus+0x348/0x3c0
[ 285.388341] ? aa_sk_perm+0x177/0x390
[ 285.388856] ? __pfx_aa_sk_perm+0x10/0x10
[ 285.389441] ? check_stack_object+0x22/0x70
[ 285.390032] ? inet_send_prepare+0x2f/0x120
[ 285.390603] ? __pfx_inet_sendmsg+0x10/0x10
[ 285.391172] sock_sendmsg+0xcc/0xe0
[ 285.391667] __sys_sendto+0x190/0x230
[ 285.392168] ? __pfx___sys_sendto+0x10/0x10
[ 285.392727] ? kvm_clock_get_cycles+0x14/0x30
[ 285.393328] ? set_normalized_timespec64+0x57/0x70
[ 285.393980] ? _raw_spin_unlock_irq+0x1b/0x40
[ 285.394578] ? __x64_sys_clock_gettime+0x11c/0x160
[ 285.395225] ? __pfx___x64_sys_clock_gettime+0x10/0x10
[ 285.395908] ? _copy_to_user+0x3e/0x60
[ 285.396432] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.397086] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.397734] ? do_syscall_64+0x71/0x90
[ 285.398258] __x64_sys_sendto+0x74/0x90
[ 285.398786] do_syscall_64+0x64/0x90
[ 285.399273] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.399949] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.400605] ? do_syscall_64+0x71/0x90
[ 285.401124] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.401807] RIP: 0033:0x495726
[ 285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09
[ 285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726
[ 285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000
[ 285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c
[ 285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634
[ 285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000
[ 285.410403] </TASK>
[ 285.410704]
[ 285.410929] Allocated by task 144:
[ 285.411402] kasan_save_stack+0x1e/0x40
[ 285.411926] kasan_set_track+0x21/0x30
[ 285.412442] __kasan_slab_alloc+0x55/0x70
[ 285.412973] kmem_cache_alloc_node+0x187/0x3d0
[ 285.413567] __alloc_skb+0x1b4/0x230
[ 285.414060] __ip_append_data+0x17f7/0x1b60
[ 285.414633] ip_append_data+0x97/0xf0
[ 285.415144] raw_sendmsg+0x5a8/0x12d0
[ 285.415640] sock_sendmsg+0xcc/0xe0
[ 285.416117] __sys_sendto+0x190/0x230
[ 285.416626] __x64_sys_sendto+0x74/0x90
[ 285.417145] do_syscall_64+0x64/0x90
[ 285.417624] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.418306]
[ 285.418531] Freed by task 144:
[ 285.418960] kasan_save_stack+0x1e/0x40
[ 285.419469] kasan_set_track+0x21/0x30
[ 285.419988] kasan_save_free_info+0x27/0x40
[ 285.420556] ____kasan_slab_free+0x109/0x1a0
[ 285.421146] kmem_cache_free+0x1c2/0x450
[ 285.421680] __netif_receive_skb_core+0x2ce/0x1870
[ 285.422333] __netif_receive_skb_one_core+0x97/0x140
[ 285.423003] process_backlog+0x100/0x2f0
[ 285.423537] __napi_poll+0x5c/0x2d0
[ 285.424023] net_rx_action+0x2be/0x560
[ 285.424510] __do_softirq+0x11b/0x3de
[ 285.425034]
[ 285.425254] The buggy address belongs to the object at ffff8880bad31280
[ 285.425254] which belongs to the cache skbuff_head_cache of size 224
[ 285.426993] The buggy address is located 40 bytes inside of
[ 285.426993] freed 224-byte region [ffff8880bad31280, ffff8880bad31360)
[ 285.428572]
[ 285.428798] The buggy address belongs to the physical page:
[ 285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31
[ 285.430758] flags: 0x100000000000200(slab|node=0|zone=1)
[ 285.431447] page_type: 0xffffffff()
[ 285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000
[ 285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 285.433562] page dumped because: kasan: bad access detected
[ 285.434144]
[ 285.434320] Memory state around the buggy address:
[ 285.434828] ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.435580] ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 285.436777] ^
[ 285.437106] ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 285.437616] ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.438126] ==================================================================
[ 285.438662] Disabling lock debugging due to kernel taint
Fix this by:
1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a
function compatible with non-work-conserving qdiscs
2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq.
Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: valis <sec@valis.email>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
commit eb76ae2165f95d31ad199d706840140b271c719e
Author: Davide Caratti <dcaratti@redhat.com>
Date: Thu Jan 25 15:45:42 2024 +0100
net: sched: sch_qfq: Use non-work-conserving warning handler
JIRA: https://issues.redhat.com/browse/RHEL-14397
Upstream Status: net.git commit 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77
commit 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77
Author: Liu Jian <liujian56@huawei.com>
Date: Mon Oct 23 14:47:29 2023 +0800
net: sched: sch_qfq: Use non-work-conserving warning handler
A helper function for printing non-work-conserving alarms is added in
commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving
warning handler."). In this commit, use qdisc_warn_nonwc() instead of
WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc.
Signed-off-by: Liu Jian <liujian56@huawei.com>
Link: https://lore.kernel.org/r/20231023064729.370649-1-liujian56@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Ryan Sullivan <rysulliv@redhat.com>
---
net/sched/klp_cve_2023_4921.h | 16 +++++++++++++
net/sched/sch_atm.c | 5 ++--
net/sched/sch_drr.c | 3 ++-
net/sched/sch_dsmark.c | 3 ++-
net/sched/sch_hfsc.c | 7 +++---
net/sched/sch_multiq.c | 4 +++-
net/sched/sch_prio.c | 6 ++++-
net/sched/sch_qfq.c | 43 ++++++++++++++++++++++++++---------
net/sched/sch_red.c | 3 ++-
net/sched/sch_sfb.c | 3 ++-
net/sched/sch_tbf.c | 3 ++-
11 files changed, 73 insertions(+), 23 deletions(-)
create mode 100644 net/sched/klp_cve_2023_4921.h
diff --git a/net/sched/klp_cve_2023_4921.h b/net/sched/klp_cve_2023_4921.h
new file mode 100644
index 000000000000..07a5624a487c
--- /dev/null
+++ b/net/sched/klp_cve_2023_4921.h
@@ -0,0 +1,16 @@
+#ifndef __KLP_CVE_2023_4921__
+#define __KLP_CVE_2023_4921__
+
+static inline struct sk_buff *klp_cve_2023_4921_peek(struct Qdisc *sch)
+{
+ /*
+ * kpatch workaround: can't modify plug_qdisc_ops structure, so
+ * provide a peek pivot based on the underlying qdisc ops id
+ */
+ if (strcmp(sch->ops->id, "plug") == 0)
+ return qdisc_peek_dequeued(sch);
+
+ return sch->ops->peek(sch);
+}
+
+#endif
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 7c8966a42794..d58c84b3fba2 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -16,6 +16,7 @@
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
+#include "klp_cve_2023_4921.h"
/*
* The ATM queuing discipline provides a framework for invoking classifiers
@@ -474,7 +475,7 @@ static void sch_atm_dequeue(unsigned long data)
* If traffic is properly shaped, this won't generate nasty
* little bursts. Otherwise, it may ... (but that's okay)
*/
- while ((skb = flow->q->ops->peek(flow->q))) {
+ while ((skb = klp_cve_2023_4921_peek(flow->q))) {
if (!atm_may_send(flow->vcc, skb->truesize))
break;
@@ -528,7 +529,7 @@ static struct sk_buff *atm_tc_peek(struct Qdisc *sch)
pr_debug("atm_tc_peek(sch %p,[qdisc %p])\n", sch, p);
- return p->link.q->ops->peek(p->link.q);
+ return klp_cve_2023_4921_peek(p->link.q);
}
static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 9bfe7b50115f..27dd8e610da2 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -17,6 +17,7 @@
#include <net/sch_generic.h>
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
+#include "klp_cve_2023_4921.h"
struct drr_class {
struct Qdisc_class_common common;
@@ -378,7 +379,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
goto out;
while (1) {
cl = list_first_entry(&q->active, struct drr_class, alist);
- skb = cl->qdisc->ops->peek(cl->qdisc);
+ skb = klp_cve_2023_4921_peek(cl->qdisc);
if (skb == NULL) {
qdisc_warn_nonwc(__func__, cl->qdisc);
goto out;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index df08e15e6f19..06b6e03f89ea 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -17,6 +17,7 @@
#include <net/dsfield.h>
#include <net/inet_ecn.h>
#include <asm/byteorder.h>
+#include "klp_cve_2023_4921.h"
/*
* classid class marking
@@ -327,7 +328,7 @@ static struct sk_buff *dsmark_peek(struct Qdisc *sch)
pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
- return p->q->ops->peek(p->q);
+ return klp_cve_2023_4921_peek(p->q);
}
static int dsmark_init(struct Qdisc *sch, struct nlattr *opt)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index fb14b551f65d..466244c57737 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -67,6 +67,7 @@
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
#include <asm/div64.h>
+#include "klp_cve_2023_4921.h"
/*
* kernel internal service curve representation:
@@ -834,7 +835,8 @@ qdisc_peek_len(struct Qdisc *sch)
struct sk_buff *skb;
unsigned int len;
- skb = sch->ops->peek(sch);
+ skb = klp_cve_2023_4921_peek(sch);
+
if (unlikely(skb == NULL)) {
qdisc_warn_nonwc("qdisc_peek_len", sch);
return 0;
@@ -1567,8 +1569,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
* to invalidate the deadline.
*/
if (cl->cl_flags & HFSC_RSC)
- cl->qdisc->ops->peek(cl->qdisc);
-
+ klp_cve_2023_4921_peek(cl->qdisc);
}
qdisc_qstats_backlog_inc(sch, skb);
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 31e0a284eeff..8f6e85b2c8b8 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -26,6 +26,7 @@
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
+#include "klp_cve_2023_4921.h"
struct multiq_sched_data {
u16 bands;
@@ -145,7 +146,8 @@ static struct sk_buff *multiq_peek(struct Qdisc *sch)
if (!netif_xmit_stopped(
netdev_get_tx_queue(qdisc_dev(sch), curband))) {
qdisc = q->queues[curband];
- skb = qdisc->ops->peek(qdisc);
+ skb = klp_cve_2023_4921_peek(qdisc);
+
if (skb)
return skb;
}
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index faf447b60b68..23526ef54f0c 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -21,6 +21,7 @@
#include <net/netlink.h>
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
+#include "klp_cve_2023_4921.h"
struct prio_sched_data {
int bands;
@@ -103,7 +104,10 @@ static struct sk_buff *prio_peek(struct Qdisc *sch)
for (prio = 0; prio < q->bands; prio++) {
struct Qdisc *qdisc = q->queues[prio];
- struct sk_buff *skb = qdisc->ops->peek(qdisc);
+ struct sk_buff *skb;
+
+ skb = klp_cve_2023_4921_peek(qdisc);
+
if (skb)
return skb;
}
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index ca8c79456c80..134cd66225c0 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -18,6 +18,8 @@
#include <net/sch_generic.h>
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
+#include <linux/string.h>
+#include "klp_cve_2023_4921.h"
/* Quick Fair Queueing Plus
@@ -984,19 +986,24 @@ static void qfq_update_eligible(struct qfq_sched *q)
}
/* Dequeue head packet of the head class in the DRR queue of the aggregate. */
-static void agg_dequeue(struct qfq_aggregate *agg,
- struct qfq_class *cl, unsigned int len)
+static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
+ struct qfq_class *cl, unsigned int len)
{
- qdisc_dequeue_peeked(cl->qdisc);
+ struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);
+
+ if (!skb)
+ return NULL;
cl->deficit -= (int) len;
if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
list_del(&cl->alist);
- else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
+ else if (cl->deficit < qdisc_pkt_len(klp_cve_2023_4921_peek(cl->qdisc))) {
cl->deficit += agg->lmax;
list_move_tail(&cl->alist, &agg->active);
}
+
+ return skb;
}
static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
@@ -1006,10 +1013,16 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
struct sk_buff *skb;
*cl = list_first_entry(&agg->active, struct qfq_class, alist);
- skb = (*cl)->qdisc->ops->peek((*cl)->qdisc);
- if (skb == NULL)
- WARN_ONCE(1, "qfq_dequeue: non-workconserving leaf\n");
- else
+ skb = klp_cve_2023_4921_peek((*cl)->qdisc);
+ if (skb == NULL) {
+ /*
+ * kpatch-build workaround: keep old WARN_ONCE to avoid
+ * create-diff-object unreconcilable difference from
+ * unsupported .data.once section change.
+ */
+ WARN_ONCE(!jiffies, "qfq_dequeue: non-workconserving leaf\n");
+ qdisc_warn_nonwc("qfq_dequeue", (*cl)->qdisc);
+ } else
*len = qdisc_pkt_len(skb);
return skb;
@@ -1142,11 +1155,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
if (!skb)
return NULL;
- qdisc_qstats_backlog_dec(sch, skb);
sch->q.qlen--;
+
+ skb = agg_dequeue(in_serv_agg, cl, len);
+
+ if (!skb) {
+ sch->q.qlen++;
+ return NULL;
+ }
+
+ qdisc_qstats_backlog_dec(sch, skb);
qdisc_bstats_update(sch, skb);
- agg_dequeue(in_serv_agg, cl, len);
/* If lmax is lowered, through qfq_change_class, for a class
* owning pending packets with larger size than the new value
* of lmax, then the following condition may hold.
@@ -1224,6 +1244,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
}
pr_debug("qfq_enqueue: cl = %x\n", cl->common.classid);
+
if (unlikely(cl->agg->lmax < qdisc_pkt_len(skb))) {
pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
cl->agg->lmax, qdisc_pkt_len(skb), cl->common.classid);
@@ -1252,7 +1273,7 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
agg = cl->agg;
/* if the queue was not empty, then done here */
if (cl->qdisc->q.qlen != 1) {
- if (unlikely(skb == cl->qdisc->ops->peek(cl->qdisc)) &&
+ if (unlikely(skb == klp_cve_2023_4921_peek(cl->qdisc)) &&
list_first_entry(&agg->active, struct qfq_class, alist)
== cl && cl->deficit < qdisc_pkt_len(skb))
list_move_tail(&cl->alist, &agg->active);
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index e4789760457a..eea80e402219 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -22,6 +22,7 @@
#include <net/pkt_cls.h>
#include <net/inet_ecn.h>
#include <net/red.h>
+#include "klp_cve_2023_4921.h"
/* Parameters, settable by user:
@@ -135,7 +136,7 @@ static struct sk_buff *red_peek(struct Qdisc *sch)
struct red_sched_data *q = qdisc_priv(sch);
struct Qdisc *child = q->qdisc;
- return child->ops->peek(child);
+ return klp_cve_2023_4921_peek(child);
}
static void red_reset(struct Qdisc *sch)
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index aeb509bde740..f8d75735351f 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -27,6 +27,7 @@
#include <net/pkt_sched.h>
#include <net/pkt_cls.h>
#include <net/inet_ecn.h>
+#include "klp_cve_2023_4921.h"
/*
* SFB uses two B[l][n] : L x N arrays of bins (L levels, N bins per level)
@@ -445,7 +446,7 @@ static struct sk_buff *sfb_peek(struct Qdisc *sch)
struct sfb_sched_data *q = qdisc_priv(sch);
struct Qdisc *child = q->qdisc;
- return child->ops->peek(child);
+ return klp_cve_2023_4921_peek(child);
}
/* No sfb_drop -- impossible since the child doesn't return the dropped skb. */
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 15a19519aa9c..9957adc1b951 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -21,6 +21,7 @@
#include <net/netlink.h>
#include <net/sch_generic.h>
#include <net/pkt_sched.h>
+#include "klp_cve_2023_4921.h"
/* Simple Token Bucket Filter.
@@ -214,7 +215,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
struct tbf_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
- skb = q->qdisc->ops->peek(q->qdisc);
+ skb = klp_cve_2023_4921_peek(q->qdisc);
if (skb) {
s64 now;
--
2.44.0