From nobody Mon Feb 9 16:18:05 2026 Received: from mail-05.mail-europe.com (mail-05.mail-europe.com [85.9.206.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C1DA47A0DF for ; Wed, 21 Jan 2026 13:21:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=85.9.206.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769001686; cv=none; b=OpTyUtJQgeDz4jbGSS0WJv9EZjdmsIZcOX6sxHfbaAVVhsmf4PbLNgxZhumHdUlJE9w1/ywOYFRHDYlSJZWgpNguJKMJmHOdwz1cbIAQy1kV7zoRn/shQqrOBkWEHKgCgUayP+xdl6owC76Wkt7Ac2B/jFTPY1RlAUTJh/p69LM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769001686; c=relaxed/simple; bh=/n6viW2cIV8LYeCmJQypGF6fqiDa/c1MK40py9z2tfU=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IqvZySTu3gl/ddweX4v+nJUR1DMrx5ngfuGYpcPJPogI3FXhPCO+uA3sdVNHiKk2VhYWA130zk7lTzZ6YLuVUKeJjpQYOgUW88sAjUgIDyZmj2i05081q4h0xEwBP+HJ9X86TbZud5x+wLtUXXFeC/SgTU+65DjjIX+Izj7vEMM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=1g4.org; spf=pass smtp.mailfrom=1g4.org; dkim=pass (2048-bit key) header.d=1g4.org header.i=@1g4.org header.b=mauM2t60; arc=none smtp.client-ip=85.9.206.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=1g4.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=1g4.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=1g4.org header.i=@1g4.org header.b="mauM2t60" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1g4.org; s=protonmail2; t=1769001667; x=1769260867; bh=HIKw1+wqe+XvmTdmySUfDBlg9ZDTRrTVJ1eruFyu27M=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=mauM2t60zXNLdv2Xg0TMv888hzxTB+ybh/oihFakJZBA7xe7Ztgeojbb5X3n7ZBo/ G+GsbXjYaHqiCxZWnFIN5XHejQBGviCzfQDKB+DE21B0JQRTS76Gc3IyDjOJt2zweL 8gLOGprs5o0+g7MLYlllSuUb2JSgfyxATaprwkvB3zYQ6dZ3SyN1/bovwmDtN34uAF OFDcKIjIYNFTd4/Vxng01iZmV/7T1C+AtdPldvHTm4zU6P+UmKjcZ/YKEEByFdsn0a WvPu9Dj98FJfHWs3gNmZPVRdBS9tzD4fBZME+W8zCcv+pm+xPh7qC0iwlaBOPYwEVM OrXAZFXAmEa6g== Date: Wed, 21 Jan 2026 13:21:03 +0000 To: netdev@vger.kernel.org From: Paul Moses Cc: Jamal Hadi Salim , Cong Wang , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org, Paul Moses , stable@vger.kernel.org Subject: [PATCH net v3 7/7] net/sched: act_gate: guard NULL params in accessors Message-ID: <20260121131954.2710459-8-p@1g4.org> In-Reply-To: <20260121131954.2710459-1-p@1g4.org> References: <20260121131954.2710459-1-p@1g4.org> Feedback-ID: 8253658:user:proton X-Pm-Message-ID: 6856574e11b1bd9d0c7295a64c4cb9c34798e67f Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Guard NULL params in accessors/dump/timer paths to avoid crashes during teardown or failed initialization. Other actions already guard params before RCU cleanup (act_pedit, commit 52cf89f78c01bf; act_vlan, commits 4c5b9d9642= c859 and 1edf8abe04090c), so act_gate should tolerate NULL in reader paths too. Fixes: a51c328df310 ("net: qos: introduce a gate control flow action") Signed-off-by: Paul Moses Cc: stable@vger.kernel.org --- include/net/tc_act/tc_gate.h | 30 ++++++++++++++++++++---------- net/sched/act_gate.c | 13 ++++++++++++- 2 files changed, 32 insertions(+), 11 deletions(-) diff --git a/include/net/tc_act/tc_gate.h b/include/net/tc_act/tc_gate.h index 9587d9e9fa38f..8c3309b0dd779 100644 --- a/include/net/tc_act/tc_gate.h +++ b/include/net/tc_act/tc_gate.h @@ -54,12 +54,13 @@ struct tcf_gate { =20 static inline s32 tcf_gate_prio(const struct tc_action *a) { - s32 tcfg_prio; + s32 tcfg_prio =3D 0; struct tcf_gate_params *p; =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); - tcfg_prio =3D p->tcfg_priority; + if (p) + tcfg_prio =3D p->tcfg_priority; rcu_read_unlock(); =20 return tcfg_prio; @@ -67,12 +68,13 @@ static inline s32 tcf_gate_prio(const struct tc_action = *a) =20 static inline u64 tcf_gate_basetime(const struct tc_action *a) { - u64 tcfg_basetime; + u64 tcfg_basetime =3D 0; struct tcf_gate_params *p; =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); - tcfg_basetime =3D p->tcfg_basetime; + if (p) + tcfg_basetime =3D p->tcfg_basetime; rcu_read_unlock(); =20 return tcfg_basetime; @@ -80,12 +82,13 @@ static inline u64 tcf_gate_basetime(const struct tc_act= ion *a) =20 static inline u64 tcf_gate_cycletime(const struct tc_action *a) { - u64 tcfg_cycletime; + u64 tcfg_cycletime =3D 0; struct tcf_gate_params *p; =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); - tcfg_cycletime =3D p->tcfg_cycletime; + if (p) + tcfg_cycletime =3D p->tcfg_cycletime; rcu_read_unlock(); =20 return tcfg_cycletime; @@ -93,12 +96,13 @@ static inline u64 tcf_gate_cycletime(const struct tc_ac= tion *a) =20 static inline u64 tcf_gate_cycletimeext(const struct tc_action *a) { - u64 tcfg_cycletimeext; + u64 tcfg_cycletimeext =3D 0; struct tcf_gate_params *p; =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); - tcfg_cycletimeext =3D p->tcfg_cycletime_ext; + if (p) + tcfg_cycletimeext =3D p->tcfg_cycletime_ext; rcu_read_unlock(); =20 return tcfg_cycletimeext; @@ -106,12 +110,13 @@ static inline u64 tcf_gate_cycletimeext(const struct = tc_action *a) =20 static inline u32 tcf_gate_num_entries(const struct tc_action *a) { - u32 num_entries; + u32 num_entries =3D 0; struct tcf_gate_params *p; =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); - num_entries =3D p->num_entries; + if (p) + num_entries =3D p->num_entries; rcu_read_unlock(); =20 return num_entries; @@ -128,6 +133,11 @@ static inline struct action_gate_entry =20 rcu_read_lock(); p =3D rcu_dereference(to_gate(a)->param); + if (!p) { + rcu_read_unlock(); + return NULL; + } + num_entries =3D p->num_entries; =20 list_for_each_entry(entry, &p->entries, list) diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c index e4134b9a4a314..65b53cbf37e67 100644 --- a/net/sched/act_gate.c +++ b/net/sched/act_gate.c @@ -82,7 +82,11 @@ static enum hrtimer_restart gate_timer_func(struct hrtim= er *timer) =20 p =3D rcu_dereference_protected(gact->param, lockdep_is_held(&gact->tcf_lock)); + if (!p) + goto out_unlock; next =3D gact->next_entry; + if (!next) + goto out_unlock; =20 /* cycle start, clear pending bit, clear total octets */ gact->current_gate_status =3D next->gate_state ? GATE_ACT_GATE_OPEN : 0; @@ -119,6 +123,11 @@ static enum hrtimer_restart gate_timer_func(struct hrt= imer *timer) spin_unlock(&gact->tcf_lock); =20 return HRTIMER_RESTART; + +out_unlock: + spin_unlock(&gact->tcf_lock); + + return HRTIMER_NORESTART; } =20 TC_INDIRECT_SCOPE int tcf_gate_act(struct sk_buff *skb, @@ -584,8 +593,8 @@ static void tcf_gate_cleanup(struct tc_action *a) struct tcf_gate *gact =3D to_gate(a); struct tcf_gate_params *p; =20 - p =3D rcu_replace_pointer(gact->param, NULL, lockdep_rtnl_is_held()); hrtimer_cancel(&gact->hitimer); + p =3D rcu_replace_pointer(gact->param, NULL, lockdep_rtnl_is_held()); if (p) call_rcu(&p->rcu, tcf_gate_params_free_rcu); } @@ -643,6 +652,8 @@ static int tcf_gate_dump(struct sk_buff *skb, struct tc= _action *a, =20 rcu_read_lock(); p =3D rcu_dereference(gact->param); + if (!p) + goto nla_put_failure_rcu; =20 if (nla_put_u64_64bit(skb, TCA_GATE_BASE_TIME, p->tcfg_basetime, TCA_GATE_PAD)) --=20 2.52.GIT