From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F3384F30C1; Tue, 13 Oct 2026 12:03:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791893015; cv=none; b=Z/0O6uvHokAHpmxBBckcwsIXAAQF097ZL/bS9rjPfNiQGGpdkyqPvITe5KbTPZAr1hs5ou9SnklvKmFn6+BuVlDLCDdfI4Jf4UgyNMAm2zjWI8Uil+WuvI70EsqCpnnPJeieyNpCxXolqYegEtFCveUiGpBfiABAJmApcuoraI4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791893015; c=relaxed/simple; bh=HkUcxYeVliiM1KcQguZt4hvSxDQLtlQPO+lWE6mQu6s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hUsfNKSEyZlN98uUN7hzHNlyRXEr+WG0KcNtGtdQJyayH0vHtm+in4Xa3sGtrdSjOlDnx8CV7Fymqc8luhZxXil1/yLm89QWsT44e5jUmng7+3JoD8a1bAIr0d/z0ayoTq+RhY/yoEtfodXifKFQSvqNMIzNfYqWDTv6Mjqoo6o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sagT98eG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="sagT98eG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4B5E1F000FF; Tue, 13 Oct 2026 12:03:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791893014; bh=P/A41yFQFqvHC9CAmGx9pWG9B1X7GFi3hhTKzfM3gKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=sagT98eGvK1QmZOh5grhqtVwfKbsCJUODoUfT7wMkISN91Onc5LKcFqM9eMPnAqw+ R1gwVKSnqqLH2s/kiJ42OzptNuKiK0XuzyFOERn4bwGwSEyBr7xUCFsDbL63SwE8zZ YUf/8IQRUHPxtCh0LWdgpIk9YzSIT/Nti29gFJfs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, co+2cf741c3005abc20@bugs.sh, Weiming Shi , Jakub Kicinski Subject: [PATCH 6.18 084/621] net: team: stop reusing skb after queue override Date: Tue, 13 Oct 2026 13:31:19 +0200 Message-ID: <20261013112922.847530232@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261013112920.855194808@linuxfoundation.org> References: <20261013112920.855194808@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Weiming Shi commit b7454f1940c5e6d92e753853c476a769e452f30a upstream. A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb. Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ... Cc: stable@vger.kernel.org Fixes: 8ff5105a2b9d ("team: add support for queue override by setting queue_id for port") Reported-by: Signed-off-by: Weiming Shi Link: https://patch.msgid.link/20261001182326.572045-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/team/team_core.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -822,7 +822,8 @@ static struct list_head *__team_get_qom_ /* * note: already called with rcu_read_lock */ -static bool team_queue_override_transmit(struct team *team, struct sk_buff *skb) +static bool team_queue_override_transmit(struct team *team, struct sk_buff *skb, + bool *tx_success) { struct list_head *qom_list; struct team_port *port; @@ -830,11 +831,11 @@ static bool team_queue_override_transmit if (!team->queue_override_enabled || !skb->queue_mapping) return false; qom_list = __team_get_qom_list(team, skb->queue_mapping); - list_for_each_entry_rcu(port, qom_list, qom_list) { - if (!team_dev_queue_xmit(team, port, skb)) - return true; - } - return false; + port = list_first_or_null_rcu(qom_list, struct team_port, qom_list); + if (!port) + return false; + *tx_success = !team_dev_queue_xmit(team, port, skb); + return true; } static void __team_queue_override_port_del(struct team *team, @@ -1700,8 +1701,7 @@ static netdev_tx_t team_xmit(struct sk_b bool tx_success; unsigned int len = skb->len; - tx_success = team_queue_override_transmit(team, skb); - if (!tx_success) + if (!team_queue_override_transmit(team, skb, &tx_success)) tx_success = READ_ONCE(team->ops.transmit)(team, skb); if (tx_success) { struct team_pcpu_stats *pcpu_stats;