Merge: [sch_htb] BUG: kernel NULL pointer dereference, address: 00000000000001a8

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7217

JIRA: https://issues.redhat.com/browse/RHEL-107693

commit ffdde7b
Author: Victor Nogueira <victor@mojatatu.com>
Date:   Mon Jul 7 18:08:01 2025 -0300

    net/sched: Abort __tc_modify_qdisc if parent class does not exist

    Lion's patch [1] revealed an ancient bug in the qdisc API.
    Whenever a user creates/modifies a qdisc specifying as a parent another
    qdisc, the qdisc API will, during grafting, detect that the user is
    not trying to attach to a class and reject. However grafting is
    performed after qdisc_create (and thus the qdiscs' init callback) is
    executed. In qdiscs that eventually call qdisc_tree_reduce_backlog
    during init or change (such as fq, hhf, choke, etc), an issue
    arises. For example, executing the following commands:

    sudo tc qdisc add dev lo root handle a: htb default 2
    sudo tc qdisc add dev lo parent a: handle beef fq

    Qdiscs such as fq, hhf, choke, etc unconditionally invoke
    qdisc_tree_reduce_backlog() in their control path init() or change() which
    then causes a failure to find the child class; however, that does not stop
    the unconditional invocation of the assumed child qdisc's qlen_notify with
    a null class. All these qdiscs make the assumption that class is non-null.

    The solution is ensure that qdisc_leaf() which looks up the parent
    class, and is invoked prior to qdisc_create(), should return failure on
    not finding the class.
    In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the
    parentid doesn't correspond to a class, so that we can detect it
    earlier on and abort before qdisc_create is called.

    [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/

    Fixes: 5e50da0 ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs")
    Reported-by: syzbot+d8b58d7b0ad89a678a16@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/
    Reported-by: syzbot+5eccb463fa89309d8bdc@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/
    Reported-by: syzbot+1261670bbdefc5485a06@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/
    Reported-by: syzbot+15b96fc3aac35468fe77@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/
    Reported-by: syzbot+4dadc5aecf80324d5a51@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: Victor Nogueira <victor@mojatatu.com>
    Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Approved-by: Ivan Vecera <ivecera@redhat.com>
Approved-by: Hangbin Liu <haliu@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Jarod Wilson <jarod@redhat.com>

Author: jarodwilson

net/sched/sch_api.c

@@ -334,17 +334,22 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
 	return q;
 }
 
-static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
+static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid,
+				struct netlink_ext_ack *extack)
 {
 	unsigned long cl;
 	const struct Qdisc_class_ops *cops = p->ops->cl_ops;
 
-	if (cops == NULL)
-		return NULL;
+	if (cops == NULL) {
+		NL_SET_ERR_MSG(extack, "Parent qdisc is not classful");
+		return ERR_PTR(-EOPNOTSUPP);
+	}
 	cl = cops->find(p, classid);
 
-	if (cl == 0)
-		return NULL;
+	if (cl == 0) {
+		NL_SET_ERR_MSG(extack, "Specified class not found");
+		return ERR_PTR(-ENOENT);
+	}
 	return cops->leaf(p, cl);
 }
 
@@ -1517,7 +1522,7 @@ static int __tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 					NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid");
 					return -ENOENT;
 				}
-				q = qdisc_leaf(p, clid);
+				q = qdisc_leaf(p, clid, extack);
 			} else if (dev_ingress_queue(dev)) {
 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
 			}
@@ -1528,6 +1533,8 @@ static int __tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 			NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
 			return -ENOENT;
 		}
+		if (IS_ERR(q))
+			return PTR_ERR(q);
 
 		if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
 			NL_SET_ERR_MSG(extack, "Invalid handle");
@@ -1626,7 +1633,9 @@ static int __tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 					NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
 					return -ENOENT;
 				}
-				q = qdisc_leaf(p, clid);
+				q = qdisc_leaf(p, clid, extack);
+				if (IS_ERR(q))
+					return PTR_ERR(q);
 			} else if (dev_ingress_queue_create(dev)) {
 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
 			}