CVE-2024-26669

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26669
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26669.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26669
Downstream
Related
Published
2024-04-02T06:43:30Z
Modified
2025-10-09T02:51:54.560055Z
Summary
net/sched: flower: Fix chain template offload
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: flower: Fix chain template offload

When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the 'FLOWBLOCKUNBIND' command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the 'reoffload' operation of the classifier being used. In turn, the classifier in its 'reoffload' operation prepares and emits a 'FLOWCLSDESTROY' command for each filter.

However, the stack does not do the same for chain templates and the underlying driver never receives a 'FLOWCLSTMPLT_DESTROY' command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].

Fix by introducing a 'tmpltreoffload' operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the 'FLOWCLSTMPLT{CREATE,DESTROY}' command based on whether a flow offload callback is being bound to a filter block or being unbound from one.

As far as I can tell, the issue happens since cited commit which reordered tcfblockoffloadunbind() before tcfblockflushallchains() in _tcfblockput(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains.

[1] unreferenced object 0xffff888107e28800 (size 2048): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): b1 a6 7c 11 81 88 ff ff e0 5b b3 10 81 88 ff ff ..|......[...... 01 00 00 00 00 00 00 00 e0 aa b0 84 ff ff ff ff ................ backtrace: [<ffffffff81c06a68>] kmemcacheallocnode+0x1e8/0x320 [<ffffffff81ab374e>] _kmalloc+0x4e/0x90 [<ffffffff832aec6d>] mlxswspaclrulesetget+0x34d/0x7a0 [<ffffffff832bc195>] mlxswspflowertmpltcreate+0x145/0x180 [<ffffffff832b2e1a>] mlxswspflowblockcb+0x1ea/0x280 [<ffffffff83a10613>] tcsetupcbcall+0x183/0x340 [<ffffffff83a9f85a>] fltmpltcreate+0x3da/0x4c0 [<ffffffff83a22435>] tcctlchain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlinkrcvmsg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlinkrcvskb+0x170/0x440 [<ffffffff83ac6270>] netlinkunicast+0x540/0x820 [<ffffffff83ac6e28>] netlinksendmsg+0x8d8/0xda0 [<ffffffff83793def>] _syssendmsg+0x30f/0xa80 [<ffffffff8379d29a>] syssendmsg+0x13a/0x1e0 [<ffffffff8379d50c>] _syssendmsg+0x11c/0x1f0 [<ffffffff843b9ce0>] dosyscall64+0x40/0xe0 unreferenced object 0xffff88816d2c0400 (size 1024): comm "tc", pid 1079, jiffies 4294958525 (age 3074.287s) hex dump (first 32 bytes): 40 00 00 00 00 00 00 00 57 f6 38 be 00 00 00 00 @.......W.8..... 10 04 2c 6d 81 88 ff ff 10 04 2c 6d 81 88 ff ff ..,m......,m.... backtrace: [<ffffffff81c06a68>] _kmemcacheallocnode+0x1e8/0x320 [<ffffffff81ab36c1>] _kmallocnode+0x51/0x90 [<ffffffff81a8ed96>] kvmallocnode+0xa6/0x1f0 [<ffffffff82827d03>] buckettablealloc.isra.0+0x83/0x460 [<ffffffff82828d2b>] rhashtableinit+0x43b/0x7c0 [<ffffffff832aed48>] mlxswspaclrulesetget+0x428/0x7a0 [<ffffffff832bc195>] mlxswspflowertmpltcreate+0x145/0x180 [<ffffffff832b2e1a>] mlxswspflowblockcb+0x1ea/0x280 [<ffffffff83a10613>] tcsetupcbcall+0x183/0x340 [<ffffffff83a9f85a>] fltmpltcreate+0x3da/0x4c0 [<ffffffff83a22435>] tcctlchain+0xa15/0x1170 [<ffffffff838a863c>] rtnetlinkrcvmsg+0x3cc/0xed0 [<ffffffff83ac87f0>] netlinkrcvskb+0x170/0x440 [<ffffffff83ac6270>] netlinkunicast+0x540/0x820 [<ffffffff83ac6e28>] netlinksendmsg+0x8d8/0xda0 [<ffffffff83793def>] sys_sendmsg+0x30f/0xa80

[2] # tc qdisc add dev swp1 clsact # tc chain add dev swp1 ingress proto ip chain 1 flower dst_ip 0.0.0.0/32 # tc qdisc del dev ---truncated---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bbf73830cd48cff1599811d4f69c7cfd49c7b869
Fixed
9ed46144cff3598a5cf79955630e795ff9af5b97
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bbf73830cd48cff1599811d4f69c7cfd49c7b869
Fixed
c04709b2cc99ae31c346f79f0211752d7b74df01
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bbf73830cd48cff1599811d4f69c7cfd49c7b869
Fixed
32f2a0afa95fae0d1ceec2ff06e0e816939964b8

Affected versions

v5.*

v5.0
v5.0-rc6
v5.0-rc7
v5.0-rc8
v5.1
v5.1-rc1
v5.1-rc2
v5.1-rc3
v5.1-rc4
v5.1-rc5
v5.1-rc6
v5.1-rc7
v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.2
v5.2-rc1
v5.2-rc2
v5.2-rc3
v5.2-rc4
v5.2-rc5
v5.2-rc6
v5.2-rc7
v5.3
v5.3-rc1
v5.3-rc2
v5.3-rc3
v5.3-rc4
v5.3-rc5
v5.3-rc6
v5.3-rc7
v5.3-rc8
v5.4
v5.4-rc1
v5.4-rc2
v5.4-rc3
v5.4-rc4
v5.4-rc5
v5.4-rc6
v5.4-rc7
v5.4-rc8
v5.5
v5.5-rc1
v5.5-rc2
v5.5-rc3
v5.5-rc4
v5.5-rc5
v5.5-rc6
v5.5-rc7
v5.6
v5.6-rc1
v5.6-rc2
v5.6-rc3
v5.6-rc4
v5.6-rc5
v5.6-rc6
v5.6-rc7
v5.7
v5.7-rc1
v5.7-rc2
v5.7-rc3
v5.7-rc4
v5.7-rc5
v5.7-rc6
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
6.6.15
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.3