linux/net
Eric Dumazet dd9442aedb net/sched: act_ife: avoid possible NULL deref
[ Upstream commit 27880b0b0d ]

tcf_ife_encode() must make sure ife_encode() does not return NULL.

syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166
CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
 <TASK>
  ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101
  tcf_ife_encode net/sched/act_ife.c:841 [inline]
  tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877
  tc_act include/net/tc_wrapper.h:130 [inline]
  tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152
  tcf_exts_exec include/net/pkt_cls.h:349 [inline]
  mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42
  tc_classify include/net/tc_wrapper.h:197 [inline]
  __tcf_classify net/sched/cls_api.c:1764 [inline]
  tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860
  multiq_classify net/sched/sch_multiq.c:39 [inline]
  multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66
  dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147
  __dev_xmit_skb net/core/dev.c:4262 [inline]
  __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798

Fixes: 295a6e06d2 ("net/sched: act_ife: Change to use ife module")
Reported-by: syzbot+5cf914f193dffde3bd3c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6970d61d.050a0220.706b.0010.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yotam Gigi <yotam.gi@gmail.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260121133724.3400020-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-02-06 16:41:55 +01:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: fix memory leak in atm_register_sysfs when device_register fail 2025-09-09 18:50:20 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: fix OOB read/write in network-coding decode 2025-09-09 18:50:21 +02:00
bluetooth Bluetooth: Add more enc key size check 2025-12-07 06:09:36 +09:00
bpf bpf: Set run context for rawtp test_run callback 2024-07-05 09:14:06 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress 2026-01-19 13:10:16 +01:00
caif caif: fix integer underflow in cffrml_receive() 2026-01-19 13:09:44 +01:00
can net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 2026-02-06 16:41:47 +01:00
ceph libceph: make calc_target() set t->paused, not just clear it 2026-01-19 13:10:14 +01:00
core net: update netdev_lock_{type,name} 2026-02-06 16:41:45 +01:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx 2025-12-07 06:09:25 +09:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() 2026-01-19 13:10:13 +01:00
hsr net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() 2026-01-19 13:09:46 +01:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 fou: Don't allow 0 for FOU_ATTR_IPPROTO. 2026-02-06 16:41:52 +01:00
ipv6 ipv6: annotate data-race in ndisc_router_discovery() 2026-02-06 16:41:55 +01:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key Revert "xfrm: destroy xfrm_state synchronously on net exit path" 2026-01-19 13:09:18 +01:00
l2tp l2tp: avoid one data-race in l2tp_tunnel_del_work() 2026-02-06 16:41:53 +01:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: Discard Beacon frames to non-broadcast address 2026-01-19 13:10:11 +01:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Prevent duplicate binds 2025-08-28 16:24:20 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: pm: ignore unknown endpoint flags 2026-01-19 13:10:07 +01:00
ncsi net: ncsi: Fix buffer overflow in fetching version id 2025-08-28 16:24:22 +02:00
netfilter netfilter: nf_conncount: update last_gc only when GC has been performed 2026-01-19 13:10:16 +01:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: Fix memory leak in nr_sendmsg() 2026-01-19 13:09:43 +01:00
nfc net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write 2026-01-19 13:10:03 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch net: openvswitch: Avoid needlessly taking the RTNL on vport destroy 2026-01-19 13:09:56 +01:00
packet net/packet: fix a race in packet_set_ring() and packet_notifier() 2025-08-28 16:24:14 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: Update packets cloning when broadcasting 2024-10-17 15:11:08 +02:00
rds rds: Fix endianness annotation for RDS_MPATH_HASH 2025-12-07 06:09:19 +09:00
rfkill net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer 2025-10-02 13:39:09 +02:00
rose net: rose: fix invalid array index in rose_kill_by_device() 2026-01-19 13:09:58 +01:00
rxrpc rxrpc: Fix oops due to non-existence of prealloc backlog struct 2025-07-17 18:30:48 +02:00
sched net/sched: act_ife: avoid possible NULL deref 2026-02-06 16:41:55 +01:00
sctp sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT 2026-02-06 16:41:52 +01:00
smc net/smc: fix mismatch between CLC header and proposal 2025-12-07 06:09:27 +09:00
strparser strparser: Fix signed/unsigned mismatch bug 2025-12-07 06:09:29 +09:00
sunrpc SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf 2026-01-19 13:10:08 +01:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: Fix use-after-free in tipc_mon_reinit_self(). 2025-12-07 06:09:27 +09:00
tls net: tls: Cancel RX async resync request on rcd_delta overflow 2025-12-07 06:09:31 +09:00
unix af_unix: Don't leave consecutive consumed OOB skbs. 2025-10-02 13:39:14 +02:00
vmw_vsock vsock: Ignore signal/timeout on connect() if already established 2025-12-07 06:09:31 +09:00
wireless wifi: avoid kernel-infoleak from struct iw_point 2026-01-19 13:10:14 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-03-26 18:21:23 -04:00
xdp xsk: fix OOB map writes when deleting elements 2024-12-14 19:51:33 +01:00
xfrm xfrm: flush all states in xfrm_state_fini 2026-01-19 13:09:19 +01:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00