tree b8379bdf400a798c9a81d664aeda51f5408e233e
parent ce6f966228d2cbee5068dd0ff8a02a16d118ed4a
author Jakub Kicinski <kuba@kernel.org> 1708007626 -0800
committer Anil Altinay <aaltinay@google.com> 1746487425 -0700

net/sched: act_mirred: don't override retval if we already lost the skb

commit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 upstream.

If we're redirecting the skb, and haven't called tcf_mirred_forward(),
yet, we need to tell the core to drop the skb by setting the retcode
to SHOT. If we have called tcf_mirred_forward(), however, the skb
is out of our hands and returning SHOT will lead to UaF.

Move the retval override to the error path which actually need it.

BUG=b/388468765
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-26739 in the Linux kernel.

cos-patch: security-high
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Fixes: e5cf1baf92cb ("act_mirred: use TC_ACT_REINSERT when possible")
Change-Id: I90196ae07bd418fabc95f98c74259938e577fb01
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Minor conflict resolved due to code context change.]
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/101547
Reviewed-by: Michael Kochera <kochera@google.com>
Reviewed-by: Anil Altinay <aaltinay@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>