Jérémy Jean 7b16eb9110 net/sched: fix use-after-free in __tcf_action_put() ... __tcf_action_put() decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to access freed memory. KASAN reports it as: BUG: KASAN: slab-use-after-free in __tcf_action_put+0x327/0x340 Write of size 4 at addr ff11000000d46420 by task tc-put-pause/64 Hold the action IDR mutex across both counter updates and IDR removal, keeping cleanup outside the lock. Fixes: 16af606739 ("net: sched: implement reference counted action release") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20261008181348.527035-2-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2026-10-15 13:00:02 +02:00
..
6lowpan	net: 6lowpan: fix mismatched comments	2026-09-02 09:03:06 +02:00
9p
802
8021q	vlan: ensure sufficient headroom in vlan_dev_hard_header()	2026-09-24 11:00:59 -07:00
atm	pppoatm: ensure a writable skb header and linear data	2026-09-15 17:07:01 -07:00
batman-adv	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
bluetooth	Bluetooth: ISO: Serialize concurrent connect calls	2026-10-05 13:10:47 -04:00
bpf	bpf: Use kvfree() in xdp_test_run_teardown()	2026-09-12 12:11:41 -07:00
bridge	ipv4: validate checksum_start before completing checksum	2026-10-08 11:03:47 -07:00
can	can: fix unique skb identifier regression under RPS	2026-10-01 17:05:03 +02:00
ceph	libceph: remove pinning assertion in ceph_msg_data_iter_next()	2026-09-02 12:23:05 +02:00
core	net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()	2026-10-08 10:57:41 -07:00
dcb
devlink	devlink: fix devlink_rel reference leak when notify work is pending	2026-10-06 17:16:14 -07:00
dns_resolver	keys, dns: Drop unused NUL terminator from upayload->data	2026-08-10 16:20:42 -07:00
dsa	net: dsa: tag_brcm: legacy FCS: request needed tailroom	2026-09-09 13:31:08 -07:00
ethernet
ethtool	net: ethtool: let tsconfig reach a PHY-only timestamp provider	2026-09-28 19:26:41 -07:00
handshake
hsr	net: hsr: enable promiscuous mode on interlink port with fwd offload	2026-09-10 08:45:00 -07:00
ieee802154	ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink	2026-09-02 09:54:27 +02:00
ife	net/sched: act_ife: Only operate on Ethernet frames	2026-08-24 11:59:59 -07:00
ipv4	ipv4: do not warn on route notification size race	2026-10-08 11:32:36 -07:00
ipv6	calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()	2026-10-15 12:50:03 +02:00
iucv	net/iucv: fix the recvmsg window update	2026-08-31 15:51:22 -07:00
kcm	net: kcm: Hold RCU read lock while running BPF parser	2026-08-17 13:43:58 -07:00
key
l2tp	net: l2tp: do not propagate multicast notification errors	2026-08-24 11:43:28 -07:00
l3mdev
lapb
llc	llc: fix skb UAF and leaks on llc_mac_hdr_init() failure	2026-09-24 11:00:59 -07:00
mac80211	wifi: mac80211: don't estimate airtime for unsupported rate widths	2026-10-07 12:46:15 +02:00
mac802154	mac802154: fix use-after-free of sdata via queued RX frames	2026-09-03 11:00:54 +02:00
mctp	net/mctp: publish the mctp_dev only after it is initialised	2026-09-25 16:34:40 -07:00
mpls	Summary	2026-08-20 08:46:41 -07:00
mptcp	mptcp: fix bad accounting in __mptcp_subflow_push_pending()	2026-09-17 08:14:33 -07:00
ncsi
netfilter	ipv4: validate checksum_start before completing checksum	2026-10-08 11:03:47 -07:00
netlabel
netlink	netlink: avoid hashing the network namespace pointer	2026-10-15 10:27:45 +02:00
nfc	nfc: llcp: fix slab-out-of-bounds reads when logging service names	2026-09-23 22:13:17 +02:00
nsh
openvswitch	net: openvswitch: validate transport header presence in set_ipv6_addr	2026-10-08 11:33:38 -07:00
packet	net/packet: call packet_parse_headers after virtio_net_hdr_to_skb	2026-10-08 10:59:20 -07:00
phonet
psample
psp	net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()	2026-09-16 19:18:24 -07:00
qrtr	net: qrtr: resend HELLO on MHI resume	2026-09-20 11:21:10 -07:00
rds	net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure	2026-10-12 18:12:03 +02:00
rfkill
rxrpc	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
sched	net/sched: fix use-after-free in __tcf_action_put()	2026-10-15 13:00:02 +02:00
sctp	sctp: revalidate output stream after association connect wait	2026-10-13 10:28:23 +02:00
shaper
smc	net/smc: protect clcsock lifetime in smc_getname	2026-10-08 11:33:12 -07:00
strparser	strparser: make sure __strp_recv isn't running before tearing down the parser	2026-10-06 18:29:12 -07:00
sunrpc	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
switchdev
tipc	tipc: destroy topsrv workqueues before closing connections	2026-10-02 08:20:15 +01:00
tls	tls: device: fix out-of-bounds write in tls_append_frag()	2026-08-25 10:04:02 +02:00
unix	af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().	2026-09-15 16:45:05 -07:00
vmw_vsock	vsock: treat TCP_CLOSING as once-established	2026-10-12 16:55:20 +02:00
wireless	wifi: cfg80211: preserve hidden-group beacon IE ownership	2026-09-22 10:47:54 +02:00
x25
xdp	xsk: Use a 32-bit compare in xsk_map_gen_lookup	2026-09-17 10:56:16 -07:00
xfrm	ipv4: validate checksum_start before completing checksum	2026-10-08 11:03:47 -07:00
compat.c	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c	Major changes:	2026-08-20 07:36:20 -07:00
sysctl_net.c	net: enforce net sysctl registration	2026-08-13 13:12:21 +02:00