github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.2
linux/net/sched
History
Jamal Hadi Salim 120977e2c0 net/sched: cls_bpf: reject dev-bound programs bound to a different device 
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via
bpf_prog_get_type_dev() but never verified that a device-bound (offloaded)
program's bound netdev matches the TC netdev the classifier is being
attached to. This let a program loaded with prog_ifindex for device A be
attached via cls_bpf + skip_sw to device B; deleting device A then
destroyed the program's offload state while it was still attached to
device B, triggering a netdevsim WARN (panic with panic_on_warn=1).

Mirror the XDP attach path (net/core/dev.c) and reject the attach with
-EINVAL when a dev-bound program's bound device does not match the
target device.

Fixes: 2b3486bc2d ("bpf: Introduce device-bound XDP programs")
Reported-by: vega@nebusec.ai
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://patch.msgid.link/20260809094418.901607-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13 11:08:39 +02:00
..
act_api.c net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain 2026-08-11 18:21:46 -07:00
act_bpf.c net/sched: act_bpf: use rcu_dereference_bh() to read the filter 2026-06-30 18:27:26 -07:00
act_connmark.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_csum.c net/sched: act_csum: don't mangle UDP tunnel GSO packets 2026-06-14 13:27:39 +02:00
act_ct.c net/sched: act_ct: fix sk_buff leak when the header checks reject a packet 2026-08-10 16:37:07 -07:00
act_ctinfo.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_gact.c net/sched: act_gact, act_police: range check the fallback control action 2026-08-10 16:00:19 -07:00
act_gate.c net/sched: act_gate: snapshot parameters with RCU on replace 2026-02-27 16:10:36 -08:00
act_ife.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_meta_mark.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbprio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_meta_skbtcindex.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
act_mirred.c net/sched: act_mirred: Fix return code in early mirred redirect error paths 2026-05-28 12:26:36 +02:00
act_mpls.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_nat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_pedit.c net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 2026-07-06 12:52:01 +02:00
act_police.c net/sched: act_gact, act_police: range check the fallback control action 2026-08-10 16:00:19 -07:00
act_sample.c net: sched: act_sample: add action cookie to sample 2024-07-05 17:45:47 -07:00
act_simple.c net/sched: Remove redundant memset(0) call in reset_policy() 2025-08-12 17:13:29 -07:00
act_skbedit.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_skbmod.c net/sched: rename qstats_overlimit_inc() to qstats_cpu_overlimit_inc() 2026-04-29 16:42:44 -07:00
act_tunnel_key.c net/sched: act_tunnel_key: Defer dst_release to RCU callback 2026-07-17 12:13:20 +02:00
act_vlan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bpf_qdisc.c bpf: net_sched: Use the correct destructor kfunc type 2026-01-12 18:53:57 -08:00
cls_api.c net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers 2026-08-04 16:35:45 +02:00
cls_basic.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_bpf.c net/sched: cls_bpf: reject dev-bound programs bound to a different device 2026-08-13 11:08:39 +02:00
cls_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_flow.c net/sched: cls_flow: Dont expose folded kernel pointers 2026-06-11 15:04:56 -07:00
cls_flower.c net/sched: cls_flower: revert unintended changes 2026-04-30 13:47:01 +02:00
cls_fw.c net/sched: cls_fw: fix NULL dereference of "old" filters before change() 2026-04-12 08:49:13 -07:00
cls_matchall.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cls_route.c net/sched: cls_route: fix fastmap use-after-free on filter 2026-07-31 17:26:40 -07:00
cls_u32.c net/sched: cls_u32: skip hash tables in u32_bind_class() 2026-08-11 18:28:43 -07:00
em_canid.c net/sched: em_canid: fix uninit-value in em_canid_match 2025-11-26 16:28:10 +01:00
em_cmp.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_ipset.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_ipt.c sched: consistently handle layer3 header accesses in the presence of VLANs 2020-07-03 14:34:53 -07:00
em_meta.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_nbyte.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_text.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_u32.c net: fill in MODULE_DESCRIPTION()s for net/sched 2024-02-09 14:12:02 -08:00
ematch.c net_sched: reject TCF_EM_SIMPLE case for complex ematch module 2022-12-19 09:43:18 +00:00
Kconfig sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
Makefile sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
sch_api.c net/sched: reject overly deep qdisc hierarchies 2026-08-06 15:24:44 +02:00
sch_blackhole.c Revert "net: sched: Pass root lock to Qdisc_ops.enqueue" 2020-07-16 16:48:34 -07:00
sch_cake.c net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter 2026-08-03 18:44:20 -07:00
sch_cbs.c net: sched: avoid printing uninitialized link speed 2026-06-11 15:44:55 +02:00
sch_choke.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_codel.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-06-16 14:59:58 -07:00
sch_drr.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_dualpi2.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_etf.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_ets.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_fifo.c pfifo_tail_enqueue: Drop new packet when sch->limit == 0 2025-02-05 18:13:58 -08:00
sch_fq_codel.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_fq_pie.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_fq.c net_sched: sch_fq: convert skb->tstamp if not monotonic 2026-06-08 16:00:06 -07:00
sch_frag.c net: convert remaining ipv6_stub users to direct function calls 2026-03-29 11:21:23 -07:00
sch_generic.c net: do not acquire dev->tx_global_lock in netdev_watchdog_up() 2026-06-23 14:40:33 -07:00
sch_gred.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_hfsc.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_hhf.c net/sched: hhf: clear heavy-hitter state on reset 2026-07-01 09:09:38 +01:00
sch_htb.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_ingress.c clsact: Fix use-after-free in init/destroy rollback asymmetry 2026-03-17 12:09:16 +01:00
sch_mq.c net/sched: mq: no longer acquire qdisc spinlocks in dump operations 2026-05-11 18:28:08 -07:00
sch_mqprio_lib.c net: sched: Fill in missing MODULE_DESCRIPTION for qdiscs 2023-11-01 21:49:09 -07:00
sch_mqprio_lib.h net/sched: mqprio: allow per-TC user input of FP adminStatus 2023-04-13 22:22:10 -07:00
sch_mqprio.c net/sched: mq_prio: no longer acquire qdisc spinlocks in mqprio_dump_class_stats() 2026-05-11 18:28:08 -07:00
sch_multiq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_netem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
sch_pie.c net/sched: sch_pie: annotate more data-races in pie_dump_stats() 2026-05-01 17:54:57 -07:00
sch_plug.c net/sched: Add module aliases for cls_,sch_,act_ modules 2024-02-02 10:57:55 -08:00
sch_prio.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_qfq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_red.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfb.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_sfq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_skbprio.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_taprio.c net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked 2026-06-26 18:52:26 -07:00
sch_tbf.c net/sched: tbf: add extack to offload params 2026-05-22 17:23:37 -07:00
sch_teql.c net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants 2026-07-03 16:02:38 +02:00