Re: [PATCH net] net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

[Davide Caratti <dcaratti@redhat.com>]

On Sun, Aug 09, 2026 at 05:09:28AM -0400, Jamal Hadi Salim wrote:
> tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking
> rcu_access_pointer(a->goto_chain) and then calling
> tcf_action_goto_chain_exec(), which does a second, independent
> rcu_dereference_bh(a->goto_chain) read and immediately dereferences
> chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact
> replace path) can clear a->goto_chain between the two reads, so the second
> read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.
> 
> Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain
> in tcf_action_exec(), checking it once for NULL, and passing the resulting
> chain pointer into tcf_action_goto_chain_exec(). This turns the split
> check/use into a single check/use on one value.
> 
> Fixes: ee3bbfe806cd ("net/sched: let actions use RCU to access 'goto_chain'")
> Reported-by: vega@nebusec.ai
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>

[...]

Reviewed-by: Davide Caratti <dcaratti@redhat.com>

Thanks!

-- 
davide