averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

Browse Source 
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking
rcu_access_pointer(a->goto_chain) and then calling
tcf_action_goto_chain_exec(), which does a second, independent
rcu_dereference_bh(a->goto_chain) read and immediately dereferences
chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact
replace path) can clear a->goto_chain between the two reads, so the second
read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.

Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain
in tcf_action_exec(), checking it once for NULL, and passing the resulting
chain pointer into tcf_action_goto_chain_exec(). This turns the split
check/use into a single check/use on one value.

Fixes: ee3bbfe806 ("net/sched: let actions use RCU to access 'goto_chain'")
Reported-by: vega@nebusec.ai
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/20260809090928.868186-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jamal Hadi Salim
2026-08-11 18:21:46 -07:00
committed by Jakub Kicinski
parent 6bcd76c134
commit f60b396ee1
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/sched/act_api.c
+5 -5
View File
@@ -41,11 +41,9 @@ int tcf_dev_queue_xmit(struct sk_buff *skb, int (*xmit)(struct sk_buff *skb))
} }
EXPORT_SYMBOL_GPL(tcf_dev_queue_xmit); EXPORT_SYMBOL_GPL(tcf_dev_queue_xmit);
static void tcf_action_goto_chain_exec(const struct tc_action *a, static void tcf_action_goto_chain_exec(const struct tcf_chain *chain,
struct tcf_result *res) struct tcf_result *res)
{ {
const struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain);
res->goto_tp = rcu_dereference_bh(chain->filter_chain); res->goto_tp = rcu_dereference_bh(chain->filter_chain);
} }
@@ -1170,12 +1168,14 @@ repeat:
return TC_ACT_OK; return TC_ACT_OK;
} }
} else if (TC_ACT_EXT_CMP(ret, TC_ACT_GOTO_CHAIN)) { } else if (TC_ACT_EXT_CMP(ret, TC_ACT_GOTO_CHAIN)) {
if (unlikely(!rcu_access_pointer(a->goto_chain))) { struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain);
if (unlikely(!chain)) {
tcf_set_drop_reason(skb, tcf_set_drop_reason(skb,
SKB_DROP_REASON_TC_CHAIN_NOTFOUND); SKB_DROP_REASON_TC_CHAIN_NOTFOUND);
return TC_ACT_SHOT; return TC_ACT_SHOT;
} }
tcf_action_goto_chain_exec(a, res); tcf_action_goto_chain_exec(chain, res);
} }
if (ret != TC_ACT_PIPE) if (ret != TC_ACT_PIPE)