Message ID | 20240716045845.1961853-2-gerald.yang@canonical.com |
---|---|
State | New |
Headers | show |
Series | net/sched: Fix conntrack use-after-free | expand |
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index b4c42b257ae7..9e7f78a8132a 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -1039,6 +1039,14 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, */ if (nf_conntrack_confirm(skb) != NF_ACCEPT) goto drop; + + /* The ct may be dropped if a clash has been resolved, + * so it's necessary to retrieve it from skb again to + * prevent UAF. + */ + ct = nf_ct_get(skb, &ctinfo); + if (!ct) + skip_add = true; } if (!skip_add)