This is a note to let you know that I've just added the patch titled net_sched: cls_route: disallow handle of 0 to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net_sched-cls_route-disallow-handle-of-0.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 02799571714dc5dd6948824b9d080b44a295f695 Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim <jhs@xxxxxxxxxxxx> Date: Sun, 14 Aug 2022 11:27:58 +0000 Subject: net_sched: cls_route: disallow handle of 0 From: Jamal Hadi Salim <jhs@xxxxxxxxxxxx> commit 02799571714dc5dd6948824b9d080b44a295f695 upstream. Follows up on: https://lore.kernel.org/all/20220809170518.164662-1-cascardo@xxxxxxxxxxxxx/ handle of 0 implies from/to of universe realm which is not very sensible. Lets see what this patch will do: $sudo tc qdisc add dev $DEV root handle 1:0 prio //lets manufacture a way to insert handle of 0 $sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \ route to 0 from 0 classid 1:10 action ok //gets rejected... Error: handle of 0 is not valid. We have an error talking to the kernel, -1 //lets create a legit entry.. sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \ classid 1:10 action ok //what did the kernel insert? $sudo tc filter ls dev $DEV parent 1:0 filter protocol ip pref 100 route chain 0 filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 //Lets try to replace that legit entry with a handle of 0 $ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \ handle 0x000a8000 route to 0 from 0 classid 1:10 action drop Error: Replacing with handle of 0 is invalid. We have an error talking to the kernel, -1 And last, lets run Cascardo's POC: $ ./poc 0 0 -22 -22 -22 Signed-off-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx> Acked-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/sched/cls_route.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -427,6 +427,11 @@ static int route4_set_parms(struct net * return -EINVAL; } + if (!nhandle) { + NL_SET_ERR_MSG(extack, "Replacing with handle of 0 is invalid"); + return -EINVAL; + } + h1 = to_hash(nhandle); b = rtnl_dereference(head->table[h1]); if (!b) { @@ -480,6 +485,11 @@ static int route4_change(struct net *net int err; bool new = true; + if (!handle) { + NL_SET_ERR_MSG(extack, "Creating with handle of 0 is invalid"); + return -EINVAL; + } + if (opt == NULL) return handle ? -EINVAL : 0; Patches currently in stable-queue which might be from jhs@xxxxxxxxxxxx are queue-4.19/net_sched-cls_route-disallow-handle-of-0.patch queue-4.19/net_sched-cls_route-remove-from-list-when-handle-is-0.patch