Jamal Hadi Salim 5057e1aca0 net/sched: act_api: use RCU with deferred freeing for action lifecycle ... When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9ca ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur. Fixes: d7fb60b9ca ("net_sched: get rid of tcfa_rcu") Suggested-by: Jakub Kicinski <kuba@kernel.org> Reported-by: Kyle Zeng <kylebot@openai.com> Tested-by: Victor Nogueira <victor@mojatatu.com> Tested-by: syzbot@syzkaller.appspotmail.com Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Tested-by: Kyle Zeng <kylebot@openai.com> Reviewed-by: Pedro Tammela <pctammela@mojatatu.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-06-01 16:52:08 -07:00
..
9p	9p: document missing enum values in kernel-doc comments	2026-04-16 02:57:01 +00:00
bluetooth	Bluetooth: serialize accept_q access	2026-05-14 09:49:56 -04:00
iucv	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
libeth	libeth, idpf: use truesize as XDP RxQ info frag_size	2026-03-05 08:02:05 -08:00
mana	net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR	2026-05-05 15:43:08 +02:00
netfilter	netfilter: nf_tables: fix dst corruption in same register operation	2026-05-22 12:28:46 +02:00
netns	ipv6: flowlabel: enforce per-netns limit for unprivileged callers	2026-05-08 14:59:14 -07:00
nfc	nfc: nci: Fix race between rfkill and nci_unregister_device().	2026-01-28 19:32:26 -08:00
page_pool	net: Slightly simplify net_mp_{open,close}_rxq	2026-04-09 18:21:46 -07:00
phonet
phy	net: phy: realtek: add dummy PHY driver for RTL8127ATF	2026-01-12 19:29:11 -08:00
psp	psp: add stats from psp spec to driver facing api	2025-11-07 18:53:57 -08:00
sctp	sctp: Remove unused declaration sctp_auth_init_hmacs()	2025-11-14 18:00:34 -08:00
tc_act	net/sched: act_ife: Fix metalist update behavior	2026-03-05 07:54:08 -08:00
6lowpan.h
act_api.h	net/sched: act_api: use RCU with deferred freeing for action lifecycle	2026-06-01 16:52:08 -07:00
addrconf.h	ipv6: addrconf: reduce default temp_valid_lft to 2 days	2026-02-17 17:12:06 -08:00
af_ieee802154.h
af_rxrpc.h
af_unix.h
af_vsock.h	vsock: add G2H fallback for CIDs not owned by H2G transport	2026-03-12 10:59:36 +01:00
ah.h
aligned_data.h
amt.h
arp.h
ax25.h	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
ax88796.h
bareudp.h
bond_3ad.h	bonding: 3ad: implement proper RCU rules for port->aggregator	2026-04-29 18:32:02 -07:00
bond_alb.h
bond_options.h
bonding.h	bonding: remove unused bond_is_first_slave and bond_is_last_slave macros	2026-04-08 19:07:08 -07:00
bpf_sk_storage.h
busy_poll.h
calipso.h
can.h	can: add CAN skb extension infrastructure	2026-02-05 11:58:39 +01:00
cfg80211-wext.h
cfg80211.h	wifi: nl80211: Add a notification to notify NAN channel evacuation	2026-03-25 20:56:55 +01:00
cfg802154.h
checksum.h
cipso_ipv4.h
cls_cgroup.h
codel.h
codel_impl.h	codel: annotate data-races in codel_dump_stats()	2026-04-08 19:18:52 -07:00
codel_qdisc.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Add port-level resource registration infrastructure	2026-04-08 19:55:38 -07:00
dropreason-core.h	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
dropreason-qdisc.h	net: sched: sch_dualpi2: use qdisc_dequeue_drop() for dequeue drops	2026-02-28 15:31:35 -08:00
dropreason.h	net: sched: introduce qdisc-specific drop reason tracing	2026-02-28 15:31:34 -08:00
dsa.h	net: dsa: add bridge member iteration macro	2026-04-06 18:30:33 -07:00
dsa_stubs.h
dscp.h
dsfield.h
dst.h	inet: add dst4_mtu() and dst6_mtu() helpers	2026-02-02 17:49:29 -08:00
dst_cache.h
dst_metadata.h
dst_ops.h
eee.h
erspan.h
esp.h
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h
firewire.h
flow.h
flow_dissector.h
flow_offload.h	net: dsa: eliminate local type for tc policers	2026-02-10 15:30:11 +01:00
fou.h
fq.h
fq_impl.h	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
garp.h
gen_stats.h
genetlink.h	genetlink: free the skb on 'group >= family->n_mcgrps'	2026-05-08 15:43:29 -07:00
geneve.h
gre.h
gro.h	gro: inline tcp6_gro_complete()	2026-01-21 19:28:32 -08:00
gro_cells.h
gso.h
gtp.h
gue.h
handshake.h
hotdata.h	net-sysfs: use rps_tag_ptr and remove metadata from rps_sock_flow_table	2026-03-04 16:54:09 -08:00
hwbm.h
icmp.h
ieee8021q.h
ieee80211_radiotap.h	wifi: mac80211: add RX flag to report radiotap VHT information	2025-10-30 08:38:51 +01:00
ieee802154_netdev.h
if_inet6.h
ife.h
inet6_connection_sock.h	tcp: move inet6_csk_update_pmtu() to tcp_ipv6.c	2026-02-24 17:47:27 -08:00
inet6_hashtables.h	tcp: Initialise ehash secrets during connect() and listen().	2026-03-05 18:50:05 -08:00
inet_common.h	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
inet_connection_sock.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-02-26 10:23:00 -08:00
inet_dscp.h
inet_ecn.h	tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers	2026-02-03 15:13:24 +01:00
inet_frag.h	inet: frags: flush pending skbs in fqdir_pre_exit()	2025-12-10 01:15:27 -08:00
inet_hashtables.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-03-26 12:09:57 -07:00
inet_sock.h	ipv6: colocate inet6_cork in inet_cork_full	2026-02-02 17:49:30 -08:00
inet_timewait_sock.h
inetpeer.h
ioam6.h	ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()	2026-02-13 12:24:05 -08:00
ip.h	net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros	2026-03-29 11:21:22 -07:00
ip6_checksum.h	udp: move udp6_csum_init() back to net/ipv6/udp.c	2026-02-24 16:30:40 -08:00
ip6_fib.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
ip6_route.h	ipv6: prepare headers for ipv6_stub removal	2026-03-29 11:21:23 -07:00
ip6_tunnel.h	net: dropreason: add SKB_DROP_REASON_RECURSION_LIMIT	2026-03-14 08:38:06 -07:00
ip_fib.h	net: ipv4: fix ARM64 alignment fault in multipath hash seed	2026-03-03 17:20:37 -08:00
ip_tunnels.h	net: increase IP_TUNNEL_RECURSION_LIMIT to 5	2026-04-03 15:52:10 -07:00
ip_vs.h	ipvs: avoid possible loop in ip_vs_dst_event on resizing	2026-05-16 12:19:56 +02:00
ipcomp.h
ipconfig.h
ipv6.h	ipv6: Implement limits on extension header parsing	2026-04-30 17:21:45 -07:00
ipv6_frag.h	inet: frags: flush pending skbs in fqdir_pre_exit()	2025-12-10 01:15:27 -08:00
iw_handler.h
kcm.h
l3mdev.h	net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()	2026-02-02 17:09:11 -08:00
lag.h
lapb.h
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h
mac80211.h	wifi: mac80211: add NAN peer schedule support	2026-04-07 15:36:03 +02:00
mac802154.h
macsec.h	macsec: use rcu_work to defer TX SA crypto cleanup out of softirq	2026-05-13 19:03:05 -07:00
mctp.h	net: mctp: fix don't require received header reserved bits to be zero	2026-04-20 11:46:57 -07:00
mctpdevice.h
mip6.h
mld.h
mpls.h
mpls_iptunnel.h
mptcp.h
mrp.h
ncsi.h
ndisc.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
neighbour.h	netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()	2026-05-16 13:22:50 +02:00
neighbour_tables.h
net_debug.h
net_failover.h
net_namespace.h	kernfs: pass struct ns_common instead of const void * for namespace tags	2026-04-09 14:36:52 +02:00
net_ratelimit.h
net_shaper.h	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
net_trackers.h
netdev_lock.h
netdev_netlink.h
netdev_queues.h	net: Proxy netdev_queue_get_dma_dev for leased queues	2026-04-09 18:21:46 -07:00
netdev_rx_queue.h	net: remove the netif_get_rx_queue_lease_locked() helpers	2026-04-09 18:26:28 -07:00
netevent.h
netkit.h
netlabel.h
netlink.h	netlink: add a nla_nest_end_safe() helper	2026-04-12 11:23:50 -07:00
netmem.h	Revert "mm: introduce a new page type for page pool in page type"	2026-05-21 19:06:13 -07:00
netprio_cgroup.h
nexthop.h
nl802154.h	nl802154: fix some kernel-doc warnings	2025-10-20 17:13:40 -07:00
nsh.h	net: nsh: fix incorrect header length macros	2026-05-08 15:32:59 -07:00
pfcp.h
pie.h	net/sched: sch_pie: annotate data-races in pie_dump_stats()	2026-04-22 21:12:47 -07:00
ping.h	net: remove addr_len argument of recvmsg() handlers	2026-03-02 18:17:17 -08:00
pkt_cls.h	net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()	2025-11-24 18:53:14 -08:00
pkt_sched.h	net/sched: don't use dynamic lockdep keys with clsact/ingress/noqueue	2026-02-05 09:32:45 -08:00
pptp.h
proto_memory.h	net: Allow opt-out from global protocol memory accounting.	2025-10-16 12:04:47 -07:00
protocol.h
psample.h
psnap.h
psp.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	tcp: move __reqsk_free() out of line	2026-02-05 09:23:06 -08:00
rose.h	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
route.h
rpl.h
rps-types.h	net: add rps_tag_ptr type and helpers	2026-03-04 16:54:09 -08:00
rps.h	net-sysfs: use rps_tag_ptr and remove metadata from rps_dev_flow_table	2026-03-04 16:54:10 -08:00
rsi_91x.h
rstreason.h
rtnetlink.h
rtnh.h
sch_generic.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
sch_priv.h	net/sched: Export mq functions for reuse	2026-01-13 11:54:29 +01:00
scm.h
secure_seq.h	tcp: secure_seq: add back ports to TS offset	2026-03-04 17:44:35 -08:00
seg6.h
seg6_hmac.h
seg6_local.h
selftests.h	net: selftests: export packet creation helpers for driver use	2025-11-06 13:38:11 +01:00
slhc_vj.h
smc.h	net/smc: bpf: Introduce generic hook for handshake flow	2025-11-10 11:19:41 -08:00
snmp.h
sock.h	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
sock_reuseport.h
Space.h	drivers: net: 8390: wd80x3: Remove this driver	2026-04-23 15:57:10 -07:00
stp.h
strparser.h
switchdev.h	bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign	2026-03-19 13:14:00 +01:00
tc_wrapper.h	net/sched: refine indirect call mitigation in tc_wrapper.h	2026-03-09 19:31:41 -07:00
tcp.h	tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction	2026-05-20 19:14:06 -07:00
tcp_ao.h
tcp_ecn.h	tcp: annotate data-races around tp->delivered and tp->delivered_ce	2026-04-18 11:10:12 -07:00
tcp_states.h
tcx.h
timewait_sock.h
tipc.h
tls.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-10-31 06:46:03 -07:00
tls_prot.h
tls_toe.h
transp_v6.h	ipv6: Retire UDP-Lite.	2026-03-13 18:57:44 -07:00
tso.h	net: tso: Introduce tso_dma_map and helpers	2026-04-12 10:54:31 -07:00
tun_proto.h
udp.h	udp: Don't pass udptable to IPv4 socket lookup functions.	2026-03-13 18:57:46 -07:00
udp_tunnel.h	ipv6: remove ipv6_stub infrastructure completely	2026-03-29 11:21:24 -07:00
vsock_addr.h	net: Convert proto_ops connect() callbacks to use sockaddr_unsized	2025-11-04 19:10:32 -08:00
vxlan.h
wext.h
x25.h
x25device.h
xdp.h
xdp_priv.h
xdp_sock.h	xsk: fix XDP_UMEM_SG_FLAG issues	2026-04-06 18:43:51 -07:00
xdp_sock_drv.h	xsk: respect tailroom for ZC setups	2026-04-06 18:43:51 -07:00
xfrm.h	xfrm: route MIGRATE notifications to caller's netns	2026-05-07 09:31:10 +02:00
xsk_buff_pool.h	xsk: remove repeated defines	2026-03-16 19:28:21 -07:00