net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain

tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking
rcu_access_pointer(a->goto_chain) and then calling
tcf_action_goto_chain_exec(), which does a second, independent
rcu_dereference_bh(a->goto_chain) read and immediately dereferences
chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact
replace path) can clear a->goto_chain between the two reads, so the second
read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.

Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain
in tcf_action_exec(), checking it once for NULL, and passing the resulting
chain pointer into tcf_action_goto_chain_exec(). This turns the split
check/use into a single check/use on one value.

Fixes: ee3bbfe806cd ("net/sched: let actions use RCU to access 'goto_chain'")
Reported-by: vega@nebusec.ai
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/20260809090928.868186-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index f141634df21489495e933efbb80a18b7a5687d42..600b7804befd27341dfc04ed563b3f51753d6f0e 100644 (file)
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -41,11 +41,9 @@ int tcf_dev_queue_xmit(struct sk_buff *skb, int (*xmit)(struct sk_buff *skb))
 }
 EXPORT_SYMBOL_GPL(tcf_dev_queue_xmit);
 
-static void tcf_action_goto_chain_exec(const struct tc_action *a,
+static void tcf_action_goto_chain_exec(const struct tcf_chain *chain,
                                       struct tcf_result *res)
 {
-       const struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain);
-
        res->goto_tp = rcu_dereference_bh(chain->filter_chain);
 }
 
@@ -1170,12 +1168,14 @@ repeat:
                                        return TC_ACT_OK;
                        }
                } else if (TC_ACT_EXT_CMP(ret, TC_ACT_GOTO_CHAIN)) {
-                       if (unlikely(!rcu_access_pointer(a->goto_chain))) {
+                       struct tcf_chain *chain = rcu_dereference_bh(a->goto_chain);
+
+                       if (unlikely(!chain)) {
                                tcf_set_drop_reason(skb,
                                                    SKB_DROP_REASON_TC_CHAIN_NOTFOUND);
                                return TC_ACT_SHOT;
                        }
-                       tcf_action_goto_chain_exec(a, res);
+                       tcf_action_goto_chain_exec(chain, res);
                }
 
                if (ret != TC_ACT_PIPE)