Skip to content

[ciqlts8_6] net/sched: act_api: use RCU with deferred freeing for action lifecycle - #1486

Open
ciq-kernel-automation[bot] wants to merge 1 commit into
ciqlts8_6from
{bmastbergen}_ciqlts8_6
Open

[ciqlts8_6] net/sched: act_api: use RCU with deferred freeing for action lifecycle#1486
ciq-kernel-automation[bot] wants to merge 1 commit into
ciqlts8_6from
{bmastbergen}_ciqlts8_6

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

net/sched: act_api: use RCU with deferred freeing for action lifecycle

jira VULN-189809
cve CVE-2026-53264
commit-author Jamal Hadi Salim <jhs@mojatatu.com>
commit 5057e1aca011e51ef51498c940ef96f3d3e8a305

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 23m 43s 24m 40s
aarch64 9m 33s 10m 13s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 108 31 ciqlts8_6 ✅ No regressions
aarch64 66 21 ciqlts8_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1454 13 ciqlts8_6 ✅ No regressions
aarch64 1425 14 ciqlts8_6 ✅ No regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 30486582981

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Jul 29, 2026
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/30478277672

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 309a32df000c (net/sched: act_api: use RCU with deferred freeing for action lifecycle) → upstream 5057e1aca011
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -38,4 +38,4 @@
-	struct tc_cookie	__rcu *act_cookie;
+	struct tc_cookie	__rcu *user_cookie;
 	struct tcf_chain	__rcu *goto_chain;
 	u32			tcfa_flags;
 	u8			hw_stats;
--- b/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -135,4 +132,4 @@
 	kfree(p);
 }
 
-static void tcf_action_cleanup(struct tc_action *p)
+static void offload_action_hw_count_set(struct tc_action *act,

This is an automated interdiff check for backported commits.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

JIRA PR Check Results

1 commit(s) with issues found:

Commit 309a32df000c

Summary: net/sched: act_api: use RCU with deferred freeing for action lifecycle

❌ Errors:

  • VULN-XXXX: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-XXXX
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Wed, 29 Jul 2026 18:05:53 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '775cded3b50e2ca423fb2f6bb0e54cb4', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': '5291a2243cc54c888bb42a69eccc71e2', 'Atl-Request-Id': '5291a224-3cc5-4c88-8bb4-2a69eccc71e2', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=71,atl-edge-internal;dur=15,atl-edge-upstream;dur=56,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 2bdfafaaaec33c116889588ecd9de280.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'ORD58-P1', 'X-Amz-Cf-Id': 'sRB__73si-b6PmUjQZ1vkV8_WbAYJHGPZtVFFyY5QXep_TajdJyeHw=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Summary: Checked 1 commit(s) total.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/30478277672

@bmastbergen
net/sched: act_api: use RCU with deferred freeing for action lifecycle
b124df2 
jira VULN-189809
cve CVE-2026-53264
commit-author Jamal Hadi Salim <jhs@mojatatu.com>
commit 5057e1a

When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.

Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:

 0: mutex_lock() <-- holds the idr lock
 0: rcu_read_lock()
 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)
 0: mutex_unlock() <-- releases the idr lock
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index) <-- Action removed from IDR
 1: mutex_unlock() <-- mutex released allowing us to delete the action
 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory

This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu_head to tc_action used in the deferral and introducing a
call_rcu() in the delete path to defer the final kfree().

Note: this is a revert of commit d7fb60b ("net_sched: get rid of tcfa_rcu")
but also modernization/simplification to directly use kfree_rcu().

Let's illustrate the new restored code path:

 0: rcu_read_lock()
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index)
 1: mutex_unlock()
 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period
 0: p = idr_find(idr, index)
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0
 1: rcu_read_unlock() <-- release so freeing can run after grace period

After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.

Fixes: d7fb60b ("net_sched: get rid of tcfa_rcu")
	Suggested-by: Jakub Kicinski <kuba@kernel.org>
	Reported-by: Kyle Zeng <kylebot@openai.com>
	Tested-by: Victor Nogueira <victor@mojatatu.com>
	Tested-by: syzbot@syzkaller.appspotmail.com
	Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
	Tested-by: Kyle Zeng <kylebot@openai.com>
	Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
	Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 5057e1a)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
@bmastbergen
bmastbergen force-pushed the {bmastbergen}_ciqlts8_6 branch from 309a32d to b124df2 Compare July 29, 2026 19:56
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/30487195488

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit b124df272435 (net/sched: act_api: use RCU with deferred freeing for action lifecycle) → upstream 5057e1aca011
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -38,4 +38,4 @@
-	struct tc_cookie	__rcu *act_cookie;
+	struct tc_cookie	__rcu *user_cookie;
 	struct tcf_chain	__rcu *goto_chain;
 	u32			tcfa_flags;
 	u8			hw_stats;
--- b/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -135,4 +132,4 @@
 	kfree(p);
 }
 
-static void tcf_action_cleanup(struct tc_action *p)
+static void offload_action_hw_count_set(struct tc_action *act,

This is an automated interdiff check for backported commits.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/30487195488

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bmastbergen