Commit 0c3057a5 authored by Cong Wang's avatar Cong Wang Committed by Jakub Kicinski
Browse files

net_sched: Prevent creation of classes with TC_H_ROOT 



The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
condition when traversing up the qdisc tree to update parent backlog
counters. However, if a class is created with classid TC_H_ROOT, the
traversal terminates prematurely at this class instead of reaching the
actual root qdisc, causing parent statistics to be incorrectly maintained.
In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT
(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.

Reported-by: default avatarMingi Cho <mincho@theori.io>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Fixes: 066a3b5b ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop")
Link: https://patch.msgid.link/20250306232355.93864-2-xiyou.wangcong@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 081b5756

net/sched/sch_api.c

+6 −0
Original line number Diff line number Diff line
@@ -2254,6 +2254,12 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, 
		return -EOPNOTSUPP;

	}



	/* Prevent creation of traffic classes with classid TC_H_ROOT */

	if (clid == TC_H_ROOT) {

		NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT");

		return -EINVAL;

	}



	new_cl = cl;

	err = -EOPNOTSUPP;

	if (cops->change)