CVE-2024-46800

In the Linux kernel, the following vulnerability has been resolved:

sch/netem: fix use after free in netem_dequeue

If netem_dequeue() enqueues packet to inner qdisc and that qdisc

returns __NET_XMIT_STOLEN. The packet is dropped but

qdisc_tree_reduce_backlog() is not called to update the parent's

q.qlen, leading to the similar use-after-free as Commit

e04991a48dbaf382 ("netem: fix return value if duplicate enqueue

fails")

Commands to trigger KASAN UaF:

ip link add type dummy

ip link set lo up

ip link set dummy0 up

tc qdisc add dev lo parent root handle 1: drr

tc filter add dev lo parent 1: basic classid 1:1

tc class add dev lo classid 1:1 drr

tc qdisc add dev lo parent 1:1 handle 2: netem

tc qdisc add dev lo parent 2: handle 3: drr

tc filter add dev lo parent 3: basic classid 3:1 action mirred egress

redirect dev dummy0

tc class add dev lo classid 3:1 drr

ping -c1 -W0.01 localhost # Trigger bug

tc class del dev lo classid 1:1

tc class add dev lo classid 1:1 drr

ping -c1 -W0.01 localhost # UaF