Victor Nogueira 11cb63b0d1 net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks ... As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/ Reported-by: GangMin Kim <km.kim1503@gmail.com> Fixes: 3f14b377d0 ("net/sched: act_ct: fix skb leak and crash on ooo frags") CC: stable@vger.kernel.org Signed-off-by: Victor Nogueira <victor@mojatatu.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-02-27 19:06:21 -08:00
..
9p	9p: convert to the new mount API	2025-11-03 16:49:53 +09:00
bluetooth	Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short	2026-02-23 15:28:56 -05:00
caif
iucv	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
libeth	libeth: xdp: Disable generic kCFI pass for libeth_xdp_tx_xmit_bulk()	2025-10-29 20:04:55 -07:00
mana	RDMA v7.0 merge window	2026-02-12 17:05:20 -08:00
netfilter	netfilter pull request nf-next-26-02-06	2026-02-10 20:25:38 -08:00
netns	vsock: lock down child_ns_mode as write-once	2026-02-26 11:10:03 +01:00
nfc	nfc: nci: Fix race between rfkill and nci_unregister_device().	2026-01-28 19:32:26 -08:00
page_pool	Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'"	2026-01-20 18:06:01 -08:00
phonet
phy	net: phy: realtek: add dummy PHY driver for RTL8127ATF	2026-01-12 19:29:11 -08:00
psp	psp: add stats from psp spec to driver facing api	2025-11-07 18:53:57 -08:00
sctp	sctp: Remove unused declaration sctp_auth_init_hmacs()	2025-11-14 18:00:34 -08:00
tc_act	net/sched: act_gate: snapshot parameters with RCU on replace	2026-02-27 16:10:36 -08:00
6lowpan.h
act_api.h	net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks	2026-02-27 19:06:21 -08:00
addrconf.h	ipv6: addrconf: reduce default temp_valid_lft to 2 days	2026-02-17 17:12:06 -08:00
af_ieee802154.h
af_rxrpc.h
af_unix.h
af_vsock.h	vsock: lock down child_ns_mode as write-once	2026-02-26 11:10:03 +01:00
ah.h
aligned_data.h
amt.h
arp.h
atmclip.h
ax25.h	Summary	2026-02-18 10:45:36 -08:00
ax88796.h
bareudp.h
bond_3ad.h
bond_alb.h
bond_options.h
bonding.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-01-29 17:28:54 -08:00
bpf_sk_storage.h
busy_poll.h
calipso.h
can.h	can: add CAN skb extension infrastructure	2026-02-05 11:58:39 +01:00
cfg80211-wext.h
cfg80211.h	wifi: cfg80211: add initial UHR support	2026-02-02 10:11:07 +01:00
cfg802154.h
checksum.h
cipso_ipv4.h
cls_cgroup.h	net/cls_cgroup: Fix task_get_classid() during qdisc run	2025-09-14 11:55:04 -07:00
codel_impl.h
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: support default values for param-get and param-set	2025-11-20 19:01:22 -08:00
dropreason-core.h	net: add net.core.qdisc_max_burst	2026-01-13 10:12:11 +01:00
dropreason.h
dsa_stubs.h
dsa.h	net: dsa: add tag format for MxL862xx switches	2026-02-11 11:27:57 +01:00
dscp.h
dsfield.h
dst_cache.h
dst_metadata.h	net: dst_metadata: fix IP_DF bit not extracted from tunnel headers	2025-09-14 14:28:12 -07:00
dst_ops.h
dst.h	inet: add dst4_mtu() and dst6_mtu() helpers	2026-02-02 17:49:29 -08:00
eee.h
erspan.h
esp.h
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h
firewire.h
flow_dissector.h
flow_offload.h	net: dsa: eliminate local type for tc policers	2026-02-10 15:30:11 +01:00
flow.h
fou.h
fq_impl.h	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fq.h
garp.h
gen_stats.h
genetlink.h
geneve.h
gre.h
gro_cells.h
gro.h	gro: inline tcp6_gro_complete()	2026-01-21 19:28:32 -08:00
gso.h
gtp.h
gue.h
handshake.h
hotdata.h	net: add net.core.qdisc_max_burst	2026-01-13 10:12:11 +01:00
hwbm.h
icmp.h	ipv4: icmp: Pass IPv4 control block structure as an argument to __icmp_send()	2025-09-11 12:22:38 +02:00
ieee8021q.h
ieee80211_radiotap.h	wifi: mac80211: add RX flag to report radiotap VHT information	2025-10-30 08:38:51 +01:00
ieee802154_netdev.h
if_inet6.h
ife.h
inet_common.h	net: Convert proto callbacks from sockaddr to sockaddr_unsized	2025-11-04 19:10:33 -08:00
inet_connection_sock.h	tcp: fix potential race in tcp_v6_syn_recv_sock()	2026-02-19 14:02:19 -08:00
inet_dscp.h
inet_ecn.h	tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers	2026-02-03 15:13:24 +01:00
inet_frag.h	inet: frags: flush pending skbs in fqdir_pre_exit()	2025-12-10 01:15:27 -08:00
inet_hashtables.h	inet: annotate data-races around isk->inet_num	2026-02-27 17:16:59 -08:00
inet_sock.h	ipv6: colocate inet6_cork in inet_cork_full	2026-02-02 17:49:30 -08:00
inet_timewait_sock.h	tcp: Update bind bucket state on port release	2025-09-23 10:12:15 +02:00
inet6_connection_sock.h	tcp: populate inet->cork.fl.u.ip6 in tcp_v6_syn_recv_sock()	2026-02-10 20:57:50 -08:00
inet6_hashtables.h	inet: annotate data-races around isk->inet_num	2026-02-27 17:16:59 -08:00
inetpeer.h
ioam6.h	ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()	2026-02-13 12:24:05 -08:00
ip_fib.h
ip_tunnels.h	ipv4: ip_tunnel: spread netdev_lockdep_set_classes()	2026-01-08 18:02:35 -08:00
ip_vs.h
ip.h	inet: annotate data-races around isk->inet_num	2026-02-27 17:16:59 -08:00
ip6_checksum.h
ip6_fib.h
ip6_route.h	inet: add dst4_mtu() and dst6_mtu() helpers	2026-02-02 17:49:29 -08:00
ip6_tunnel.h
ipcomp.h
ipconfig.h
ipv6_frag.h	inet: frags: flush pending skbs in fqdir_pre_exit()	2025-12-10 01:15:27 -08:00
ipv6_stubs.h	net: Convert proto callbacks from sockaddr to sockaddr_unsized	2025-11-04 19:10:33 -08:00
ipv6.h	ipv6: fix a race in ip6_sock_set_v6only()	2026-02-17 16:45:29 -08:00
iw_handler.h
kcm.h
l3mdev.h	net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()	2026-02-02 17:09:11 -08:00
lag.h
lapb.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h
mac80211.h	wifi: mac80211: Add eMLSR/eMLMR action frame parsing support	2026-02-02 10:11:18 +01:00
mac802154.h
macsec.h
mctp.h
mctpdevice.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mptcp.h
mrp.h
ncsi.h
ndisc.h
neighbour_tables.h
neighbour.h	neighbour: Convert rwlock of struct neigh_table to spinlock.	2025-10-24 17:57:20 -07:00
net_debug.h
net_failover.h
net_namespace.h	netns: optimize netns cleaning by batching unhash_nsid calls	2026-02-06 20:01:31 -08:00
net_ratelimit.h
net_shaper.h
net_trackers.h
netdev_lock.h
netdev_netlink.h
netdev_queues.h	net: add queue config validation callback	2026-01-23 11:49:02 -08:00
netdev_rx_queue.h	Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'"	2026-01-20 18:06:01 -08:00
netevent.h
netkit.h
netlabel.h
netlink.h
netmem.h	net: inline get_netmem() and put_netmem()	2026-01-25 13:18:53 -08:00
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h	nl802154: fix some kernel-doc warnings	2025-10-20 17:13:40 -07:00
nsh.h
pfcp.h
pie.h
ping.h	net: Convert proto callbacks from sockaddr to sockaddr_unsized	2025-11-04 19:10:33 -08:00
pkt_cls.h	net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()	2025-11-24 18:53:14 -08:00
pkt_sched.h	net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue	2026-02-05 09:32:45 -08:00
pptp.h
proto_memory.h	net: Allow opt-out from global protocol memory accounting.	2025-10-16 12:04:47 -07:00
protocol.h
psample.h
psnap.h
psp.h	psp: base PSP device support	2025-09-18 12:32:06 +02:00
raw.h	net: use NUMA drop counters for softnet_data.dropped	2025-09-14 11:35:17 -07:00
rawv6.h
red.h
regulatory.h
request_sock.h	tcp: move __reqsk_free() out of line	2026-02-05 09:23:06 -08:00
rose.h
route.h
rpl.h
rps.h
rsi_91x.h
rstreason.h
rtnetlink.h
rtnh.h
sch_generic.h	net_sched: add qdisc_dequeue_drop() helper	2025-11-25 16:10:32 +01:00
sch_priv.h	net/sched: Export mq functions for reuse	2026-01-13 11:54:29 +01:00
scm.h
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h
selftests.h	net: selftests: export packet creation helpers for driver use	2025-11-06 13:38:11 +01:00
slhc_vj.h
smc.h	net/smc: bpf: Introduce generic hook for handshake flow	2025-11-10 11:19:41 -08:00
snmp.h
sock_reuseport.h
sock.h	net: Drop the lock in skb_may_tx_timestamp()	2026-02-24 11:27:29 +01:00
Space.h
stp.h
strparser.h
switchdev.h
tc_wrapper.h
tcp_ao.h	tcp: Free TCP-AO/TCP-MD5 info/keys without RCU	2025-09-11 19:05:56 -07:00
tcp_ecn.h	tcp: accecn: add tcpi_ecn_mode and tcpi_option2 in tcp_info	2026-02-03 15:13:25 +01:00
tcp_states.h
tcp.h	tcp: fix potential race in tcp_v6_syn_recv_sock()	2026-02-19 14:02:19 -08:00
tcx.h
timewait_sock.h
tipc.h
tls_prot.h
tls_toe.h
tls.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-10-31 06:46:03 -07:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h	geneve: expose gso partial features for tunnel offload	2026-01-23 11:31:14 -08:00
udp.h	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
udplite.h
vsock_addr.h	net: Convert proto_ops connect() callbacks to use sockaddr_unsized	2025-11-04 19:10:32 -08:00
vxlan.h
wext.h
x25.h
x25device.h
xdp_priv.h
xdp_sock_drv.h	Revert "Merge branch 'netkit-support-for-io_uring-zero-copy-and-af_xdp'"	2026-01-20 18:06:01 -08:00
xdp_sock.h	xsk: add indirect call for xsk_destruct_skb	2025-11-11 10:21:08 +01:00
xdp.h	bpf-next-for-netdev	2025-09-24 10:22:37 -07:00
xfrm.h	xfrm: reduce struct sec_path size	2026-02-10 20:21:48 -08:00
xsk_buff_pool.h	xsk: move cq_cached_prod_lock to avoid touching a cacheline in sending path	2026-01-15 10:07:45 +01:00