sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

net/sched: cls_flow: fix NULL pointer dereference on shared blocks 

flow_change() calls tcf_block_q() and dereferences q->handle to derive
a default baseclass.  Shared blocks leave block->q NULL, causing a NULL
deref when a flow filter without a fully qualified baseclass is created
on a shared block.

Check tcf_block_shared() before accessing block->q and return -EINVAL
for shared blocks.  This avoids the null-deref shown below:

=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
RIP: 0010:flow_change (net/sched/cls_flow.c:508)
Call Trace:
 tc_new_tfilter (net/sched/cls_api.c:2432)
 rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)
 [...]
=======================================================================

Fixes: 1abf272022 ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Xiang Mei 2026-03-30 22:02:16 -07:00 committed by Paolo Abeni
parent faeea8bbf6
commit 1a280dd4bd
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/sched/cls_flow.c
View File

@ -503,8 +503,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
} }
if (TC_H_MAJ(baseclass) == 0) { if (TC_H_MAJ(baseclass) == 0) {
struct Qdisc *q = tcf_block_q(tp->chain->block); struct tcf_block *block = tp->chain->block;
struct Qdisc *q;
if (tcf_block_shared(block)) {
NL_SET_ERR_MSG(extack,
"Must specify baseclass when attaching flow filter to block");
goto err2;
}
q = tcf_block_q(block);
baseclass = TC_H_MAKE(q->handle, baseclass); baseclass = TC_H_MAKE(q->handle, baseclass);
} }
if (TC_H_MIN(baseclass) == 0) if (TC_H_MIN(baseclass) == 0)