Commit 8853ccb0 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Zhengchao Shao
Browse files

net/sched: act_mirred: don't override retval if we already lost the skb

mainline inclusion
from mainline-v6.8-rc6
commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LZ
CVE: CVE-2024-26739

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210



--------------------------------

If we're redirecting the skb, and haven't called tcf_mirred_forward(),
yet, we need to tell the core to drop the skb by setting the retcode
to SHOT. If we have called tcf_mirred_forward(), however, the skb
is out of our hands and returning SHOT will lead to UaF.

Move the retval override to the error path which actually need it.

Reviewed-by: default avatarMichal Swiatkowski <michal.swiatkowski@linux.intel.com>
Fixes: e5cf1baf ("act_mirred: use TC_ACT_REINSERT when possible")
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>

Conflicts:
	net/sched/act_mirred.c

Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent b152f5a5
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment