net_sched: sch_sfq: fix a potential crash on gso_skb handling

JIRA: https://issues.redhat.com/browse/RHEL-96604
CVE: CVE-2025-38115
Upstream Status: net-next.git commit 82ffbe7

commit 82ffbe7
Author: Eric Dumazet <edumazet@google.com>
Date:   Fri Jun 6 16:51:27 2025 +0000

    net_sched: sch_sfq: fix a potential crash on gso_skb handling

    SFQ has an assumption of always being able to queue at least one packet.

    However, after the blamed commit, sch->q.len can be inflated by packets
    in sch->gso_skb, and an enqueue() on an empty SFQ qdisc can be followed
    by an immediate drop.

    Fix sfq_drop() to properly clear q->tail in this situation.

    Tested:

    ip netns add lb
    ip link add dev to-lb type veth peer name in-lb netns lb
    ethtool -K to-lb tso off                 # force qdisc to requeue gso_skb
    ip netns exec lb ethtool -K in-lb gro on # enable NAPI
    ip link set dev to-lb up
    ip -netns lb link set dev in-lb up
    ip addr add dev to-lb 192.168.20.1/24
    ip -netns lb addr add dev in-lb 192.168.20.2/24
    tc qdisc replace dev to-lb root sfq limit 100

    ip netns exec lb netserver

    netperf -H 192.168.20.2 -l 100 &
    netperf -H 192.168.20.2 -l 100 &
    netperf -H 192.168.20.2 -l 100 &
    netperf -H 192.168.20.2 -l 100 &

    Fixes: a53851e ("net: sched: explicit locking in gso_cpu fallback")
    Reported-by: Marcus Wichelmann <marcus.wichelmann@hetzner-cloud.de>
    Closes: https://lore.kernel.org/netdev/9da42688-bfaa-4364-8797-e9271f3bdaef@hetzner-cloud.de/
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Link: https://patch.msgid.link/20250606165127.3629486-1-edumazet@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Author: dcaratti

net/sched/sch_sfq.c

@@ -310,7 +310,10 @@ static unsigned int sfq_drop(struct Qdisc *sch, struct sk_buff **to_free)
 		/* It is difficult to believe, but ALL THE SLOTS HAVE LENGTH 1. */
 		x = q->tail->next;
 		slot = &q->slots[x];
-		q->tail->next = slot->next;
+		if (slot->next == x)
+			q->tail = NULL; /* no more active slots */
+		else
+			q->tail->next = slot->next;
 		q->ht[slot->hash] = SFQ_EMPTY_SLOT;
 		goto drop;
 	}