mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-02-14 06:44:44 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
28a12ef366ecb118db19b92120a07b0491c1958e
linux/net
History
Eric Dumazet 27880b0b0d net/sched: act_ife: avoid possible NULL deref 
tcf_ife_encode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166
CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
 <TASK>
  ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101
  tcf_ife_encode net/sched/act_ife.c:841 [inline]
  tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877
  tc_act include/net/tc_wrapper.h:130 [inline]
  tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152
  tcf_exts_exec include/net/pkt_cls.h:349 [inline]
  mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42
  tc_classify include/net/tc_wrapper.h:197 [inline]
  __tcf_classify net/sched/cls_api.c:1764 [inline]
  tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860
  multiq_classify net/sched/sch_multiq.c:39 [inline]
  multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66
  dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147
  __dev_xmit_skb net/core/dev.c:4262 [inline]
  __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798

Fixes: 295a6e06d2 ("net/sched: act_ife: Change to use ife module")
Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yotam Gigi <yotam.gi@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-01-22 08:01:44 -08:00
..
6lowpan
net: replace ND_PRINTK with dynamic debug
2025-07-10 15:27:32 -07:00
9p
Merge tag '9p-for-6.19-rc1' of https://github.com/martinetd/linux
2025-12-07 08:29:09 -08:00
802
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
8021q
net: vlan: sync VLAN features with lower device
2025-10-31 17:42:35 -07:00
appletalk
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
atm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-11-27 12:19:08 -08:00
ax25
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
batman-adv
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-10-31 06:46:03 -07:00
bluetooth
Bluetooth: hci_sync: enable PA Sync Lost event
2026-01-09 16:03:57 -05:00
bpf
bpf: Fix reference count leak in bpf_prog_test_run_xdp()
2026-01-12 16:37:40 -08:00
bridge
net: bridge: annotate data-races around fdb->{updated,used}
2026-01-09 17:36:21 -08:00
caif
caif: fix integer underflow in cffrml_receive()
2025-12-11 01:35:41 -08:00
can
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
2026-01-15 09:52:39 +01:00
ceph
libceph: make calc_target() set t->paused, not just clear it
2026-01-06 00:39:43 +01:00
core
net: add skb->data_len and (skb>end - skb->tail) to skb_dump()
2026-01-15 19:49:47 -08:00
dcb
Revert "Documentation: net: add flow control guide and document ethtool API"
2025-10-01 09:48:21 +02:00
devlink
tools: ynl-gen: add regeneration comment
2025-11-25 19:20:42 -08:00
dns_resolver
net/dns_resolver: use credential guards in dns_query()
2025-11-04 12:36:51 +01:00
dsa
net: dsa: fix off-by-one in maximum bridge ID determination
2026-01-21 19:52:29 -08:00
ethernet
net: optimize eth_type_trans() vs CONFIG_STACKPROTECTOR_STRONG=y
2025-11-24 19:27:31 -08:00
ethtool
ethtool: Avoid overflowing userspace buffer on stats query
2025-12-18 12:24:25 +01:00
handshake
net/handshake: Fix null-ptr-deref in handshake_complete()
2025-12-22 12:36:40 +01:00
hsr
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
2025-12-04 11:15:13 +01:00
ieee802154
net: Convert proto callbacks from sockaddr to sockaddr_unsized
2025-11-04 19:10:33 -08:00
ife
…
ipv4
fou: Don't allow 0 for FOU_ATTR_IPPROTO.
2026-01-17 16:00:24 -08:00
ipv6
ipv6: annotate data-race in ndisc_router_discovery()
2026-01-20 18:37:45 -08:00
iucv
net: Remove KMSG_COMPONENT macro
2025-11-28 19:20:27 -08:00
kcm
Merge tag 'net-next-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2025-12-03 17:24:33 -08:00
key
pfkey: Deprecate pfkey
2025-10-30 09:03:12 +01:00
l2tp
l2tp: avoid one data-race in l2tp_tunnel_del_work()
2026-01-19 09:55:41 -08:00
l3mdev
net: fib_rules: Fix iif / oif matching on L3 master device
2025-04-15 17:54:56 -07:00
lapb
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
llc
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
mac80211
wifi: mac80211: apply advertised TTLM from association response
2026-01-20 10:02:01 +01:00
mac802154
mac802154: Switch to use hrtimer_setup()
2025-02-18 10:35:44 +01:00
mctp
net: mctp: test: move TX packetqueue from dst to dev
2025-12-01 13:52:13 -08:00
mpls
mpls: Drop RTNL for RTM_NEWROUTE, RTM_DELROUTE, and RTM_GETROUTE.
2025-11-03 17:40:54 -08:00
mptcp
mptcp: ensure context reset on disconnect()
2025-12-23 09:12:25 +01:00
ncsi
net: ncsi: Fix buffer overflow in fetching version id
2025-06-12 18:21:59 -07:00
netfilter
netfilter: nf_conncount: update last_gc only when GC has been performed
2026-01-02 10:44:28 +01:00
netlabel
audit: add record for multiple task security contexts
2025-08-30 10:15:30 -04:00
netlink
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
netrom
netrom: fix double-free in nr_route_frame()
2026-01-20 19:15:40 -08:00
nfc
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
2025-12-28 09:15:42 +01:00
nsh
…
openvswitch
net: openvswitch: fix data race in ovs_vport_get_upcall_stats
2026-01-22 12:55:22 +01:00
packet
net: Convert struct sockaddr to fixed-size "sa_data[14]"
2025-11-04 19:10:33 -08:00
phonet
net: Convert proto callbacks from sockaddr to sockaddr_unsized
2025-11-04 19:10:33 -08:00
psample
psample: adjust size if rate_as_probability is set
2024-12-18 19:23:04 -08:00
psp
tools: ynl-gen: add regeneration comment
2025-11-25 19:20:42 -08:00
qrtr
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
rds
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
rfkill
net: replace use of system_wq with system_percpu_wq
2025-09-22 17:40:30 -07:00
rose
net: rose: fix invalid array index in rose_kill_by_device()
2025-12-30 11:45:51 +01:00
rxrpc
rxrpc: Fix data-race warning and potential load/store tearing
2026-01-21 19:59:29 -08:00
sched
net/sched: act_ife: avoid possible NULL deref
2026-01-22 08:01:44 -08:00
sctp
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
2026-01-17 15:10:34 -08:00
shaper
tools: ynl-gen: add regeneration comment
2025-11-25 19:20:42 -08:00
smc
net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT
2025-12-04 11:07:18 -08:00
strparser
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-11-13 12:35:38 -08:00
sunrpc
Merge tag 'nfsd-6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux
2025-12-24 09:23:04 -08:00
switchdev
net: switchdev: Convert blocking notification chain to a raw one
2025-03-11 11:30:28 +01:00
tipc
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-11-13 12:35:38 -08:00
tls
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-10-31 06:46:03 -07:00
unix
net: do not write to msg_get_inq in callee
2026-01-08 08:45:13 -08:00
vmw_vsock
vsock/virtio: cap TX credit to local buffer size
2026-01-22 15:41:33 +01:00
wireless
wifi: cfg80211: ignore link disabled flag from userspace
2026-01-20 10:02:01 +01:00
x25
net: Convert proto_ops connect() callbacks to use sockaddr_unsized
2025-11-04 19:10:32 -08:00
xdp
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-11-27 12:19:08 -08:00
xfrm
xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
2025-12-15 11:06:25 +01:00
compat.c
socket: Unify getsockname and getpeername implementation
2025-11-26 13:45:23 -07:00
devres.c
…
Kconfig
net: Kconfig: discourage drop_monitor enablement
2025-10-17 16:29:26 -07:00
Kconfig.debug
rtnetlink: Add per-netns RTNL.
2024-10-08 15:16:59 +02:00
Makefile
psp: base PSP device support
2025-09-18 12:32:06 +02:00
socket.c
Merge tag 'vfs-6.19-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
2025-12-05 15:52:30 -08:00
sysctl_net.c
…