Subject: CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

syzbot found hanging tasks waiting on rtnl_lock [1]

A reproducer is available in the syzbot bug.

When a request to add multiple actions with the same index is sent, the
second request will block forever on the first request. This holds
rtnl_lock, and causes tasks to hang.

Return -EAGAIN to prevent infinite looping, while keeping documented
behavior.

[1]

INFO: task kworker/1:0:5088 blocked for more than 143 seconds.
Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000
Workqueue: events_power_efficient reg_check_chans_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
wiphy_lock include/net/cfg80211.h:5953 [inline]
reg_leave_invalid_chans net/wireless/reg.c:2466 [inline]
reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481

The Linux kernel CVE team has assigned CVE-2024-40995 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.4.279 with commit 0d8a2d287c8a
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.10.221 with commit c6a7da65a296
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 5.15.162 with commit 25987a97eec4
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.1.96 with commit 6fc78d67f51a
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.6.36 with commit 5f926aa96b08
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.9.7 with commit 7a0e497b597d
	Issue introduced in 4.19 with commit 0190c1d452a9 and fixed in 6.10 with commit d864319871b0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-40995
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/sched/act_api.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74
	https://git.kernel.org/stable/c/c6a7da65a296745535a964be1019ec7691b0cb90
	https://git.kernel.org/stable/c/25987a97eec4d5f897cd04ee1b45170829c610da
	https://git.kernel.org/stable/c/6fc78d67f51aeb9a542d39a8714e16bc411582d4
	https://git.kernel.org/stable/c/5f926aa96b08b6c47178fe1171e7ae331c695fc2
	https://git.kernel.org/stable/c/7a0e497b597df7c4cf2b63fc6e9188b6cabe5335
	https://git.kernel.org/stable/c/d864319871b05fadd153e0aede4811ca7008f5d6