From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 852A237BE6F; Thu, 20 Aug 2026 17:42:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247757; cv=none; b=fWQuvuCaUMPKwCxr9JZEgc66eJEODjJEa14AbrBb730K79ILH2d+vGN32TJ8EdYBt53PM3A40agMv7ZH5iqSeROhMbqfZVHPhQByBEQAfafaFgFLua+StYs5ChuETvTAVkj/b7v/XaZ72+FvErqnmZvYwkCEuKF6z4+w0QgWqYc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247757; c=relaxed/simple; bh=l6eZQ30uMA1XaP5XI/B8uaz36Nma9VJ4GH1ORatuN38=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=olHnjyXf2S03itNQRJnxiAXqUgS3TWLGa+ruteYY+bu5pqWWnrUfGsQMMmS/3WglNwbubQMUXpm59DXYD+8Abk42RVflgceAXbxcE9xgC5pCC28HPi93MtDCGSgclFoAxjC1fWb0H1LoetMVogtCSDIAsq95H7NcSY6GGskHjvI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fFd0+oHS; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fFd0+oHS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7C061F000E9; Thu, 20 Aug 2026 17:42:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787247756; bh=+CDwuCWwkyUfbRH01yacm8KaTr3Y+3HQzNlchgk1Dvg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fFd0+oHShG0PuM3MceBEOCztC5BCHilvPmZuKiw50JHwjxhxJHZo7eFkuSx28lWVm 4YejGNXXuEra2W9b8Gc/dxxWZyQJxiHk872e7NRs2gJmSL9QGF0cD+V37Jd7eNdfZa +wpjp80VYruyLTmExKGQ1/9yvC5//8QvFGJCyIo4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, vega@nebusec.ai, Victor Nogueira , Jamal Hadi Salim , Davide Caratti , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 156/166] net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain Date: Thu, 20 Aug 2026 16:56:55 +0200 Message-ID: <20260820145215.859555985@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820145211.194104353@linuxfoundation.org> References: <20260820145211.194104353@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jamal Hadi Salim [ Upstream commit f60b396ee174206fe08ebf997d16cd3801b77b22 ] tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking rcu_access_pointer(a->goto_chain) and then calling tcf_action_goto_chain_exec(), which does a second, independent rcu_dereference_bh(a->goto_chain) read and immediately dereferences chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact replace path) can clear a->goto_chain between the two reads, so the second read returns NULL and tcf_action_goto_chain_exec() dereferences NULL. Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain in tcf_action_exec(), checking it once for NULL, and passing the resulting chain pointer into tcf_action_goto_chain_exec(). This turns the split check/use into a single check/use on one value. Fixes: ee3bbfe806cd ("net/sched: let actions use RCU to access 'goto_chain'") Reported-by: vega@nebusec.ai Tested-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Reviewed-by: Davide Caratti Link: https://patch.msgid.link/20260809090928.868186-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/sched/act_api.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 96412b374e7b4..8514888378168 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -41,11 +41,9 @@ int tcf_dev_queue_xmit(struct sk_buff *skb, int (*xmit)(struct sk_buff *skb)) } EXPORT_SYMBOL_GPL(tcf_dev_queue_xmit); -static void tcf_action_goto_chain_exec(const struct tc_action *a, +static void tcf_action_goto_chain_exec(const struct tcf_chain *chain, struct tcf_result *res) { - const struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain); - res->goto_tp = rcu_dereference_bh(chain->filter_chain); } @@ -1117,12 +1115,14 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions, return TC_ACT_OK; } } else if (TC_ACT_EXT_CMP(ret, TC_ACT_GOTO_CHAIN)) { - if (unlikely(!rcu_access_pointer(a->goto_chain))) { + struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain); + + if (unlikely(!chain)) { tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_CHAIN_NOTFOUND); return TC_ACT_SHOT; } - tcf_action_goto_chain_exec(a, res); + tcf_action_goto_chain_exec(chain, res); } if (ret != TC_ACT_PIPE) -- 2.53.0