net/sched: cls_flow: fix NULL pointer dereference on shared blocks

flow_change() calls tcf_block_q() and dereferences q->handle to derive
a default baseclass.  Shared blocks leave block->q NULL, causing a NULL
deref when a flow filter without a fully qualified baseclass is created
on a shared block.

Check tcf_block_shared() before accessing block->q and return -EINVAL
for shared blocks.  This avoids the null-deref shown below:

=======================================================================
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
RIP: 0010:flow_change (net/sched/cls_flow.c:508)
Call Trace:
 tc_new_tfilter (net/sched/cls_api.c:2432)
 rtnetlink_rcv_msg (net/core/rtnetlink.c:6980)
 [...]
=======================================================================

Fixes: 1abf272022cf ("net: sched: tcindex, fw, flow: use tcf_block_q helper to get struct Qdisc")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260331050217.504278-2-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 339c664beff6dd745e86fb010800a8dce471d63d..ab364e4e468624b1228564a44c058d4528ff4156 100644 (file)
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -503,8 +503,16 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                }
 
                if (TC_H_MAJ(baseclass) == 0) {
-                       struct Qdisc *q = tcf_block_q(tp->chain->block);
+                       struct tcf_block *block = tp->chain->block;
+                       struct Qdisc *q;
 
+                       if (tcf_block_shared(block)) {
+                               NL_SET_ERR_MSG(extack,
+                                              "Must specify baseclass when attaching flow filter to block");
+                               goto err2;
+                       }
+
+                       q = tcf_block_q(block);
                        baseclass = TC_H_MAKE(q->handle, baseclass);
                }
                if (TC_H_MIN(baseclass) == 0)