Commit 1a280dd4 authored by Xiang Mei's avatar Xiang Mei Committed by Paolo Abeni
Browse files

net/sched: cls_flow: fix NULL pointer dereference on shared blocks 



flow_change() calls tcf_block_q() and dereferences q->handle to derive
a default baseclass.  Shared blocks leave block->q NULL, causing a NULL
deref when a flow filter without a fully qualified baseclass is created
on a shared block.

Check tcf_block_shared() before accessing block->q and return -EINVAL
for shared blocks.  This avoids the null-deref shown below:

=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
RIP: 0010:flow_change (net/sched/cls_flow.c:508)
Call Trace:
 tc_new_tfilter (net/sched/cls_api.c:2432)
 rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)
 [...]
=======================================================================

Fixes: 1abf2720 ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
Reported-by: default avatarWeiming Shi <bestswngs@gmail.com>
Signed-off-by: default avatarXiang Mei <xmei5@asu.edu>
Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent faeea8bb

net/sched/cls_flow.c

+9 −1
Original line number Diff line number Diff line
@@ -503,8 +503,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, 
		}



		if (TC_H_MAJ(baseclass) == 0) {

			struct Qdisc *q = tcf_block_q(tp->chain->block);

			struct tcf_block *block = tp->chain->block;

			struct Qdisc *q;



			if (tcf_block_shared(block)) {

				NL_SET_ERR_MSG(extack,

					       "Must specify baseclass when attaching flow filter to block");

				goto err2;

			}



			q = tcf_block_q(block);

			baseclass = TC_H_MAKE(q->handle, baseclass);

		}

		if (TC_H_MIN(baseclass) == 0)