github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-16 12:50:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/net/sched
History
Jérémy Jean 7b16eb9110 net/sched: fix use-after-free in __tcf_action_put() 
__tcf_action_put() decrements the reference count before decrementing the
binding count. Another thread can free the action between these operations,
causing the binding-count update to access freed memory. KASAN reports it
as:

  BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340
  Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64

Hold the action IDR mutex across both counter updates and IDR removal,
keeping cleanup outside the lock.

Fixes: 16af606739 ("net: sched: implement reference counted action release")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20261008181348.527035-2-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-15 13:00:02 +02:00
..
act_api.c net/sched: fix use-after-free in __tcf_action_put() 2026-10-15 13:00:02 +02:00
act_bpf.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_connmark.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_csum.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
act_ct.c netfilter pull request 26-09-30 2026-10-01 12:00:40 +02:00
act_ctinfo.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_gact.c net/sched: act_gact, act_police: range check the fallback control action 2026-08-10 16:00:19 -07:00
act_gate.c net/sched: act_gate: budget the per-entry list in get_fill_size 2026-09-23 16:42:50 -07:00
act_ife.c net/sched: act_ife: validate metadata length before decoding 2026-09-24 15:28:37 +02:00
act_meta_mark.c net/sched: act_ife: validate metadata length before decoding 2026-09-24 15:28:37 +02:00
act_meta_skbprio.c net/sched: act_ife: validate metadata length before decoding 2026-09-24 15:28:37 +02:00
act_meta_skbtcindex.c net/sched: act_ife: validate metadata length before decoding 2026-09-24 15:28:37 +02:00
act_mirred.c net/sched: act_mirred: Fix return code in early mirred redirect error paths 2026-05-28 12:26:36 +02:00
act_mpls.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_nat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_pedit.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_police.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_sample.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_simple.c net/sched: Remove redundant memset(0) call in reset_policy() 2025-08-12 17:13:29 -07:00
act_skbedit.c net: cap skb->queue_mapping when the tx queue is picked 2026-09-29 17:49:35 -07:00
act_skbmod.c net/sched: act_skbmod: fix length calculations and avoid invalid header warnings 2026-08-25 11:04:12 +02:00
act_tunnel_key.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
act_vlan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bpf_qdisc.c bpf: net_sched: Use the correct destructor kfunc type 2026-01-12 18:53:57 -08:00
cls_api.c net/sched: cls_api: reclaim an empty proto on the error path 2026-09-25 17:19:23 -07:00
cls_basic.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_bpf.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_cgroup.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flow.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flower.c net/sched: cls_flower: validate mask pointer after nla_next() 2026-08-31 17:02:56 -07:00
cls_fw.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_matchall.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_route.c net/sched: cls_route: reject change with no routing attribute 2026-10-06 17:59:06 -07:00
cls_u32.c net/sched: cls_u32: fix manual hash table handle IDR aliasing 2026-09-17 17:00:28 -07:00
em_canid.c net/sched: em_canid: fix uninit-value in em_canid_match 2025-11-26 16:28:10 +01:00
em_cmp.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_ipset.c
em_ipt.c
em_meta.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_nbyte.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_text.c net/sched: em_text: reject unterminated algo before autoload 2026-10-01 17:59:43 -07:00
em_u32.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-19 09:43:18 +00:00
Kconfig sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
Makefile sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
sch_api.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c net/sched: sch_cake: fix autorate reconfiguration throttling 2026-08-22 13:51:40 -07:00
sch_cbs.c net: sched: avoid printing uninitialized link speed 2026-06-11 15:44:55 +02:00
sch_choke.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_codel.c net/sched: sch_codel: match the no-drop threshold to the packet size 2026-09-29 12:49:13 +02:00
sch_drr.c net/sched: drr: clamp quantum in change class 2026-09-05 13:48:08 -07:00
sch_dualpi2.c net/sched: dualpi2: clamp psched_mtu at all call sites 2026-09-05 13:48:02 -07:00
sch_etf.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_ets.c net/sched: ets: clamp quantum in parse and fallback paths 2026-09-05 13:48:08 -07:00
sch_fifo.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_fq_codel.c net/sched: fq_codel: match the no-drop threshold to the packet size 2026-09-29 12:49:07 +02:00
sch_fq_pie.c net/sched: fq_pie: clamp quantum in change path 2026-09-05 13:47:29 -07:00
sch_fq.c net/sched: fq: clamp quantum and initial_quantum in change path 2026-09-05 13:47:29 -07:00
sch_frag.c net: convert remaining ipv6_stub users to direct function calls 2026-03-29 11:21:23 -07:00
sch_generic.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_gred.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_hfsc.c net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget 2026-09-19 16:42:11 -07:00
sch_hhf.c net/sched: hhf: cap hh_flows_limit at change time 2026-09-15 13:30:53 +02:00
sch_htb.c net/sched: sch_htb: limit htb_classify inner-class filter hops 2026-08-27 12:47:58 -07:00
sch_ingress.c clsact: Fix use-after-free in init/destroy rollback asymmetry 2026-03-17 12:09:16 +01:00
sch_mq.c net/sched: mq: no longer acquire qdisc spinlocks in dump operations 2026-05-11 18:28:08 -07:00
sch_mqprio_lib.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_mqprio_lib.h net/sched: mqprio: allow per-TC user input of FP adminStatus 2023-04-13 22:22:10 -07:00
sch_mqprio.c net: prevent torn reads in netdev_tc_txq 2026-08-17 10:27:48 -07:00
sch_multiq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_netem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
sch_pie.c net/sched: pie: clamp psched_mtu in pie_drop_early 2026-09-05 13:48:08 -07:00
sch_plug.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_prio.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_qfq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_red.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfb.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_sfq.c net/sched: sfq: clamp quantum in change path 2026-09-05 13:47:30 -07:00
sch_skbprio.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_taprio.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_tbf.c net/sched: tbf: add extack to offload params 2026-05-22 17:23:37 -07:00
sch_teql.c net/sched: sch_teql: fix shadowed err in __teql_resolve() 2026-09-24 11:00:59 -07:00