Re: [PATCH net] net/sched: etf: propagate dequeue drops to parents

[Vinicius Costa Gomes <vinicius.gomes@intel.com>]

> From: Riley Kitchen <security@copperfault.com>
>
> etf_dequeue_timesortedlist() drops expired packets via
> timesortedlist_drop(), but that path only decrements ETF's own qlen and
> backlog. It never calls qdisc_tree_reduce_backlog(), so a classful
> parent keeps accounting packets that no longer exist.
>
> With ETF installed below QFQ, this leaves QFQ with a nonzero qlen after
> its last active aggregate has drained. qfq_dequeue() then skips its
> empty-queue early return, qfq_choose_next_agg() returns NULL, and
> qfq_peek_skb() dereferences the NULL aggregate, panicking the kernel. An
> unprivileged (uid 1000) process can trigger this deterministically after
> creating user and network namespaces; no race and no modified kernel are
> required.
>
> Count the packets and bytes dropped in timesortedlist_drop() and call
> qdisc_tree_reduce_backlog() once the local queue state is consistent, so
> classful ancestors see the removal.
>
> The issue was found and the fix developed with AI assistance. A
> standalone C reproducer, run as uid 1000 with no kernel changes,
> panicked v7.3 and mainline d135ab453a74 under KASAN; with this fix the
> reproducer exits cleanly and parent and child backlogs both reach zero.
> The reproducer is available privately on request.
>
> Fixes: 25db26a91364 ("net/sched: Introduce the ETF Qdisc")
> Cc: stable@vger.kernel.org
> Signed-off-by: Riley Kitchen <security@copperfault.com>
> ---

It seems that ETF under QFQ won't work well, as ETF can drop packets and
is not work conserving. But the patch looks good:

Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>


Cheers,
-- 
Vinicius