Re: [PATCH net] net/sched: reject IDR error pointers when deleting actions

[Jamal Hadi Salim]

On Mon, Sep 14, 2026 at 2:51 AM Weiming Shi <bestswngs@xxxxxxxxx> wrote:
>
> tcf_action_delete() drops the reference held by its lookup before calling
> tcf_idr_delete_index() with the saved action index.  An unlocked
> classifier can remove that action and reserve the same IDR slot with
> ERR_PTR(-EBUSY) in between.
>
> tcf_idr_delete_index() only checks the lookup result for NULL.  It
> therefore treats the reservation as a tc_action and dereferences
> tcfa_bindcnt.  A hardware execution breakpoint was used to schedule the
> interleaving without changing the kernel source.  KASAN reported this
> decoded trace:
>
>   BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
>   Read of size 4 at addr 0000000000000010 by task poc/150
>   Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
>   RIP: tca_action_gd+0x5c0/0x1010:
>     arch_atomic_read at arch/x86/include/asm/atomic.h:23
>     raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
>     atomic_read at include/linux/atomic/atomic-instrumented.h:33
>     tcf_idr_delete_index at net/sched/act_api.c:766
>     tcf_action_delete at net/sched/act_api.c:1859
>     tcf_del_notify at net/sched/act_api.c:2014
>     tca_action_gd at net/sched/act_api.c:2064
>   R13: 0000000000000010 R15: fffffffffffffff0
>   Kernel panic - not syncing: Fatal exception
>
> R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
> the address in R13.  With the guard applied, the same reproducer returned
> -ENOENT without a KASAN report or panic.  Treat error pointers as absent
> and return -ENOENT.
>

We test all submissions to tc. Can you provide a tdc test or reproducer (PoC)?
Please remember tto do his for any future submissions. If the
information is sensitive, please send it to me privately.

cheer,
jamal


> Fixes: 0190c1d452a9 ("net: sched: atomically check-allocate action")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Xiang Mei <xmei5@xxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
> ---
>  net/sched/act_api.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/sched/act_api.c b/net/sched/act_api.c
> index 19501dc99..eabe612b7 100644
> --- a/net/sched/act_api.c
> +++ b/net/sched/act_api.c
> @@ -758,7 +758,7 @@ static int tcf_idr_delete_index(struct tcf_idrinfo *idrinfo, u32 index)
>
>         mutex_lock(&idrinfo->lock);
>         p = idr_find(&idrinfo->action_idr, index);
> -       if (!p) {
> +       if (IS_ERR_OR_NULL(p)) {
>                 mutex_unlock(&idrinfo->lock);
>                 return -ENOENT;
>         }
>
> base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
> --
> 2.55.0
>