The context of this patch is changed compared with the original fix. Adding RFC means that I want to let the author or other experts to make a possible review to make sure the logic is right.
-----Original Message----- From: Simon Horman horms@kernel.org Sent: Saturday, March 22, 2025 02:01 To: Ren, Jianqi (Jacky) (CN) Jianqi.Ren.CN@windriver.com Cc: stable@vger.kernel.org; patches@lists.linux.dev; gregkh@linuxfoundation.org; linux-kernel@vger.kernel.org; jhs@mojatatu.com; xiyou.wangcong@gmail.com; jiri@resnulli.us; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com; netdev@vger.kernel.org; michal.swiatkowski@linux.intel.com Subject: Re: [RFC PATCH 6.1.y] net/sched: act_mirred: don't override retval if we already lost the skb
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
On Wed, Mar 19, 2025 at 09:22:25AM +0800, jianqi.ren.cn@windriver.com wrote:
From: Jakub Kicinski kuba@kernel.org
[ Upstream commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 ]
If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF.
Move the retval override to the error path which actually need it.
Reviewed-by: Michal Swiatkowski michal.swiatkowski@linux.intel.com Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible") Signed-off-by: Jakub Kicinski kuba@kernel.org Acked-by: Jamal Hadi Salim jhs@mojatatu.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Jianqi Ren jianqi.ren.cn@windriver.com Signed-off-by: He Zhe zhe.he@windriver.com
Verified the build test
Sorry if it is obvious, but I'm confused by the intention of posting an RFC for stable. Are you asking for buy-in regarding backporting this patch to 6.1.y because for some reason it hasn't already propagated there?