Re: [PATCH] net/sched: act_tunnel_key: Defer dst_release to RCU callback

[Davide Caratti <dcaratti@redhat.com>]

On Sat, Jul 11, 2026 at 11:05:37AM -0400, Jamal Hadi Salim wrote:
> Fix a race-condition use-after-free in tunnel_key_release_params().
> 
> The function releases the metadata_dst of the old params synchronously
> via dst_release() while deferring the params struct free with
> kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
> still hold the old params pointer (under rcu_read_lock_bh) and proceed
> to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's
> dst_release has already pushed the dst's rcuref to RCUREF_DEAD.

hello Jamal and Victor,

[...]
 
> Fix by moving dst_release() into a custom RCU callback that runs
> after the grace period, matching the lifetime of the containing
> params struct.  Readers in the datapath therefore always find a live
> rcuref when calling dst_clone().
> 
> Fixes: 9174c3df1cd18 ("net/sched: act_tunnel_key: fix memory leak in case of action replace")
> Reported-by: zdi-disclosures@trendmicro.com
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
>  net/sched/act_tunnel_key.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)

Thanks for this patch, LGTM!

Reviewed-by: Davide Caratti <dcaratti@redhat.com>