Re: [PATCH net] clsact: Fix use-after-free in init/destroy rollback asymmetry

[Martin KaFai Lau <martin.lau@linux.dev>]

On 3/12/26 11:55 PM, Daniel Borkmann wrote:
> Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry.
> The latter is achieved by first fully initializing a clsact instance, and
> then in a second step having a replacement failure for the new clsact qdisc
> instance. clsact_init() initializes ingress first and then takes care of the
> egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon
> failure, the kernel will trigger the clsact_destroy() callback.
> 
> Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the
> way how the transition is happening. If tcf_block_get_ext on the q->ingress_block
> ends up failing, we took the tcx_miniq_inc reference count on the ingress
> side, but not yet on the egress side. clsact_destroy() tests whether the
> {ingress,egress}_entry was non-NULL. However, even in midway failure on the
> replacement, both are in fact non-NULL with a valid egress_entry from the
> previous clsact instance.
> 
> What we really need to test for is whether the qdisc instance-specific ingress
> or egress side previously got initialized. This adds a small helper for checking
> the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon
> clsact_destroy() in order to fix the use-after-free scenario. Convert the
> ingress_destroy() side as well so both are consistent to each other.

Acked-by: Martin KaFai Lau <martin.lau@kernel.org>