Re: [PATCH] net/sched: sch_qfq: prevent aggregate self-replacement

[David Lee]

Hi Jamal,

Reproducer has been attached to this email.

========== Reproduction ==========

1. Build Linux at 82a47586c0b9266622657009aa30573dddf09f53
   with the configuration options listed above and KASAN enabled.
   Use a system with at least two CPUs. If QFQ is configured as a
   module, make sch_qfq available before running the reproducer.

2. Build the attached poc.c:

~
gcc -static -O2 -pthread -Wall -Wextra -o poc poc.c
~

3. Run the resulting binary:

~
./poc
~

The reproducer creates user and network namespaces, brings up the
loopback device, installs a QFQ qdisc and class, and races class
changes against packet enqueue. Race timing varies between systems.
On the validated KASAN kernel, the expected result is a
slab-use-after-free report in qfq_add_to_agg(), followed by a kernel
panic. The full observed output is attached as splash.txt.

he issue was reproduced on Linux 7.2-rc3 at:

82a47586c0b9266622657009aa30573dddf09f53

It is also present in Linux 7.2-rc5 at:

f5098b6bae761e346ebcd9da7f95622c04733cff

As of July 27, 2026, the vulnerable sequence remains in upstream
master at:

62cc90241548d5570ee68e01aaba6506964e9811
https://github.com/torvalds/linux/commit/62cc90241548d5570ee68e01aaba6506964e9811

Required configuration:

* CONFIG_NET_SCHED
* CONFIG_NET_SCH_QFQ

The attached reproducer additionally requires:

* CONFIG_USER_NS
* CONFIG_NET_NS
* CONFIG_INET

KASAN is recommended to observe the first invalid access.

Regarding the format, I can send v2 if the reproducer looks good on your end.

Thank you.

Best regards,
David

On Fri, Jul 31, 2026 at 12:33 PM Jamal Hadi Salim <jhs@xxxxxxxxxxxx> wrote:

On Fri, Jul 31, 2026 at 10:05 AM David Lee <david.lee@xxxxxxxxxxxxxxx> wrote:
>
> qfq_change_class() snapshots the current aggregate settings while
> holding the qdisc tree lock, but drops the lock before selecting the
> destination aggregate. During that gap, qfq_enqueue() can move the
> class to an aggregate matching the requested settings.
>
> When qfq_change_class() resumes, qfq_find_agg() then returns cl->agg.
> If it is a singleton, qfq_deact_rm_from_agg() frees the aggregate
> before qfq_add_to_agg() immediately accesses the same pointer, causing
> a use-after-free.
>
> While holding the tree lock, skip the replacement when the destination
> is already the current aggregate. Any estimator replacement has already
> completed, so the class change can finish normally.
>
> Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
> Bug found and triaged by OpenAI Security Research and
> validated by Trail of Bits.
>

Please always send a reproducer - either as a tdc test case or if it
is sensitive send it privately to me and Cc the other maintainers.
As trivial as this looks I will not look at it without a repro.

cheers,
jamal

> Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
> ---
> Trail of Bits has a reproducer for this bug that triggers a
> KASAN use-after-free and can share if needed.
>
>  net/sched/sch_qfq.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
> index 6f3b7273c..e900890e9 100644
> --- a/net/sched/sch_qfq.c
> +++ b/net/sched/sch_qfq.c
> @@ -517,11 +517,14 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
>                 sch_tree_lock(sch);
>                 qfq_init_agg(q, new_agg, lmax, weight);
>         }
> +       if (existing && new_agg == cl->agg)
> +               goto unlock;
>         if (existing)
>                 qfq_deact_rm_from_agg(q, cl);
>         else
>                 qdisc_class_hash_insert(&q->clhash, &cl->common);
>         qfq_add_to_agg(q, new_agg, cl);
> +unlock:
>         sch_tree_unlock(sch);
>         qdisc_class_hash_grow(sch, &q->clhash);
>
> --
> 2.53.0

Attachment: poc.c
Description: Binary data