Skip to content

[ciqlts9_2] net/sched: act_api: use RCU with deferred freeing for action lifecycle - #1487

Open
ciq-kernel-automation[bot] wants to merge 1 commit into
ciqlts9_2from
{bmastbergen}_ciqlts9_2
Open

[ciqlts9_2] net/sched: act_api: use RCU with deferred freeing for action lifecycle#1487
ciq-kernel-automation[bot] wants to merge 1 commit into
ciqlts9_2from
{bmastbergen}_ciqlts9_2

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

net/sched: act_api: use RCU with deferred freeing for action lifecycle

jira VULN-189811
cve CVE-2026-53264
commit-author Jamal Hadi Salim <jhs@mojatatu.com>
commit 5057e1aca011e51ef51498c940ef96f3d3e8a305

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 24m 45s 25m 36s
aarch64 17m 9s 17m 52s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 174 24 ciqlts9_2 ✅ No regressions
aarch64 140 28 ciqlts9_2 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1439 81 ciqlts9_2 ✅ No regressions
aarch64 1409 83 ciqlts9_2 ✅ No regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 30486523087

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Jul 29, 2026
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/30480210017

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 0455c4ba345 (net/sched: act_api: use RCU with deferred freeing for action lifecycle) → upstream 5057e1aca011
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -39,4 +39,4 @@
-	struct tc_cookie	__rcu *act_cookie;
+	struct tc_cookie	__rcu *user_cookie;
 	struct tcf_chain	__rcu *goto_chain;
 	u32			tcfa_flags;
 	u8			hw_stats;

This is an automated interdiff check for backported commits.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

JIRA PR Check Results

1 commit(s) with issues found:

Commit 0455c4ba345d

Summary: net/sched: act_api: use RCU with deferred freeing for action lifecycle

❌ Errors:

  • VULN-XXXX: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-XXXX
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Wed, 29 Jul 2026 18:31:40 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': 'd496553ba014a488924a2386caae79cd', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': 'f2fc4f10d61741d8962f92d77846e574', 'Atl-Request-Id': 'f2fc4f10-d617-41d8-962f-92d77846e574', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=71,atl-edge-internal;dur=18,atl-edge-upstream;dur=52,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 56bbab08f5381e532e122035df26be58.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'IAD61-P13', 'X-Amz-Cf-Id': '3no0uM7rCMnLNxN6X4OqBwBSRHs9ugquv_b1TO6sT9y-aA4t0gkovQ=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Summary: Checked 1 commit(s) total.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/30480210017

@bmastbergen
net/sched: act_api: use RCU with deferred freeing for action lifecycle
858d578 
jira VULN-189811
cve CVE-2026-53264
commit-author Jamal Hadi Salim <jhs@mojatatu.com>
commit 5057e1a

When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.

Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:

 0: mutex_lock() <-- holds the idr lock
 0: rcu_read_lock()
 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)
 0: mutex_unlock() <-- releases the idr lock
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index) <-- Action removed from IDR
 1: mutex_unlock() <-- mutex released allowing us to delete the action
 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory

This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu_head to tc_action used in the deferral and introducing a
call_rcu() in the delete path to defer the final kfree().

Note: this is a revert of commit d7fb60b ("net_sched: get rid of tcfa_rcu")
but also modernization/simplification to directly use kfree_rcu().

Let's illustrate the new restored code path:

 0: rcu_read_lock()
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index)
 1: mutex_unlock()
 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period
 0: p = idr_find(idr, index)
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0
 1: rcu_read_unlock() <-- release so freeing can run after grace period

After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.

Fixes: d7fb60b ("net_sched: get rid of tcfa_rcu")
	Suggested-by: Jakub Kicinski <kuba@kernel.org>
	Reported-by: Kyle Zeng <kylebot@openai.com>
	Tested-by: Victor Nogueira <victor@mojatatu.com>
	Tested-by: syzbot@syzkaller.appspotmail.com
	Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
	Tested-by: Kyle Zeng <kylebot@openai.com>
	Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
	Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 5057e1a)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
@bmastbergen
bmastbergen force-pushed the {bmastbergen}_ciqlts9_2 branch from 0455c4b to 858d578 Compare July 29, 2026 19:55
@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/30487038104

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 858d5784633 (net/sched: act_api: use RCU with deferred freeing for action lifecycle) → upstream 5057e1aca011
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -39,4 +39,4 @@
-	struct tc_cookie	__rcu *act_cookie;
+	struct tc_cookie	__rcu *user_cookie;
 	struct tcf_chain	__rcu *goto_chain;
 	u32			tcfa_flags;
 	u8			hw_stats;

This is an automated interdiff check for backported commits.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/30487038104

kerneltoast
kerneltoast approved these changes Jul 29, 2026
View reviewed changes

@kerneltoast kerneltoast left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kerneltoast kerneltoast kerneltoast approved these changes

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kerneltoast @bmastbergen