Linux Kernel Qdisc SFB Scheduler Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in the Linux kernel's Qdisc Stochastic Fairness Buffer (SFB) scheduler. This issue arises when the SFB scheduler has child queuing disciplines, such as Queue Fairness Queueing (QFQ), that use the 'peek' callback to indicate dequeued packets. The vulnerability can lead to a kernel panic when the parent queuing discipline, like Token Bucket Filter (TBF), attempts to retrieve a packet from the SFB child. The SFB scheduler incorrectly calls the dequeue method of its child QFQ, which can cause a null pointer dereference, as indicated by the Kernel Address Sanitizer (KASAN) error.

Impact

Exploitation of this vulnerability causes a kernel panic, leading to a denial of service by crashing the system.

Reproduction

To reproduce this vulnerability, configure a queuing discipline (qdisc) setup where the SFB scheduler has a child qdisc that uses the 'peek' callback to indicate dequeued packets. When the parent qdisc attempts to retrieve a packet from the SFB child, it will trigger the null pointer dereference, causing a kernel panic.

Remediation

The vulnerability has been addressed by modifying the SFB scheduler to use the 'qdisc_dequeue_peeked' method instead of a direct dequeue call. Users should update to the latest version of the Linux kernel where this patch is applied.