Re: [PATCH 6.1.y 2/2] net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Mar 12, 2026 at 01:18:57PM -0400, Sasha Levin wrote:
> From: Victor Nogueira <victor@mojatatu.com>
> 
> [ Upstream commit 11cb63b0d1a0685e0831ae3c77223e002ef18189 ]
> 
> As Paolo said earlier [1]:
> 
> "Since the blamed commit below, classify can return TC_ACT_CONSUMED while
> the current skb being held by the defragmentation engine. As reported by
> GangMin Kim, if such packet is that may cause a UaF when the defrag engine
> later on tries to tuch again such packet."
> 
> act_ct was never meant to be used in the egress path, however some users
> are attaching it to egress today [2]. Attempting to reach a middle
> ground, we noticed that, while most qdiscs are not handling
> TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we
> address the issue by only allowing act_ct to bind to clsact/ingress
> qdiscs and shared blocks. That way it's still possible to attach act_ct to
> egress (albeit only with clsact).
> 
> [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/
> [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/
> 
> Reported-by: GangMin Kim <km.kim1503@gmail.com>
> Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags")
> CC: stable@vger.kernel.org
> Signed-off-by: Victor Nogueira <victor@mojatatu.com>
> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  include/net/act_api.h | 1 +
>  net/sched/act_ct.c    | 6 ++++++
>  net/sched/cls_api.c   | 7 +++++++
>  3 files changed, 14 insertions(+)

Ah, it was some trivial fuzz, I've just taken this and not patch 1/2 as
that is a new feature not needed here.

thanks,

greg k-h