net_sched: ets: fix a race in ets_qdisc_change()

JIRA: https://issues.redhat.com/browse/RHEL-96604
CVE: CVE-2025-38107
Upstream Status: net-next.git commit d92adac

commit d92adac
Author: Eric Dumazet <edumazet@google.com>
Date:   Wed Jun 11 11:15:14 2025 +0000

    net_sched: ets: fix a race in ets_qdisc_change()

    Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer
    fires at the wrong time.

    The race is as follows:

    CPU 0                                 CPU 1
    [1]: lock root
    [2]: qdisc_tree_flush_backlog()
    [3]: unlock root
     |
     |                                    [5]: lock root
     |                                    [6]: rehash
     |                                    [7]: qdisc_tree_reduce_backlog()
     |
    [4]: qdisc_put()

    This can be abused to underflow a parent's qlen.

    Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
    should fix the race, because all packets will be purged from the qdisc
    before releasing the lock.

    Fixes: b05972f ("net: sched: tbf: don't call qdisc_put() while holding tree lock")
    Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
    Suggested-by: Gerrard Tai <gerrard.tai@starlabs.sg>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20250611111515.1983366-5-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Author: dcaratti

net/sched/sch_ets.c

@@ -661,7 +661,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt,
 	for (i = q->nbands; i < oldbands; i++) {
 		if (i >= q->nstrict && q->classes[i].qdisc->q.qlen)
 			list_del_init(&q->classes[i].alist);
-		qdisc_tree_flush_backlog(q->classes[i].qdisc);
+		qdisc_purge_queue(q->classes[i].qdisc);
 	}
 	WRITE_ONCE(q->nstrict, nstrict);
 	memcpy(q->prio2band, priomap, sizeof(priomap));