From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=202.12.124.140 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792681009; b=qwisCAdPjkjdaPbfGkanggGjEdimqPg+ZAyX+gexODclr8zudzry37Jdv30a1wqKlpPI TZRVpjist90DCNzer8Xpi3q17VODSlHMoHCQlgR+iJfUkgw92MC8a87vyHmFlGsXzg+49 FF57o5g8qsfrfzHrCNmE147tJ1cjywgM224VctUUriQdfGOGYXWSnjmZ/8ISe2aC+nP/i hpwXQrduHMVukNQdc5o9C/BzkDV27RGIGEYD3DyYPPwprjJ3ZN2sb2EweOpvW9tpvlM14 abCjhdXlAlb46VEsDJd4d20zDIknGh7suPrDy085Rul78YWkeIYe2Wre3lseOVL2Vfg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792681009; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; bh=MX6+H6HoEBe+UOfH0T16WLp5b6MKq0eSYY5BMOhvft0=; b=ugvZCRPMHEMIuP5L1NbZdbKxs0eV9K6eqxkhe6rSK/+EWlHTWuYhRulypvUBogfXrHlo /xTPpvh8F7FHj2eJgAcLxHd6TUD0PDxIhbHa3cmSDumXnykIASh8X3gLi71mPO+u5lbSN jsPnPwJDrlQWMgbAS7VFgzM+Clj3xHcjsYmZ965RWHaYdzZpLHhDohazWZMpP6pg0Mxk9 rOAvRbsFFVroJyEC6CzBz1VF4bKAcS6+UoyxLc/vKF+f0t7SJzsykT29QnDLgt5c59tdG FbCADDn9JmNJqXcSa4TK3XgzYVO3r9vaXgV0N7UlV1e36Ts+v621itHDaQ0qOBaOU3w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=kroah.com; spf=pass smtp.mailfrom=kroah.com; dkim=pass header.d=kroah.com header.i=@kroah.com header.a=rsa-sha256 header.s=fm2 header.b="V27M/H8Q"; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=Tbq8bCmS; arc=none smtp.remote-ip=202.12.124.140 Received: from flow-b5-smtp.messagingengine.com (flow-b5-smtp.messagingengine.com [202.12.124.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C24F0606A31E for ; Thu, 22 Oct 2026 14:56:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C24F0606A31E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kroah.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kroah.com header.i=@kroah.com header.a=rsa-sha256 header.s=fm2 header.b=V27M/H8Q; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=Tbq8bCmS Received: from phl-compute-08.internal (phl-compute-08.internal [10.202.2.48]) by mailflow.stl.internal (Postfix) with ESMTP id 51C201300128 for ; Thu, 22 Oct 2026 10:56:48 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-08.internal (MEProxy); Thu, 22 Oct 2026 10:56:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm2; t=1792681006; x=1792688206; bh=MX6+H6HoEB e+UOfH0T16WLp5b6MKq0eSYY5BMOhvft0=; b=V27M/H8QDgfwwcB+hTDnncS3wJ c0EdDb3jFouSxn8drrWGg5u8dnGEIGdbtlNJCv5zoY9GjO9xG+79i6ZsSyJxiko4 r3uTbTXOYPS1lL/kb4ya5k0njyImSQ5TW5RCiETafXU7syIwhK9xwRyXpUypXDjw l4tDyfkTWDImbPAK0awbplhRSzrjDrAG2sW6CLx2EXW4uSRsR7RAlb9pgtxD8osw 1doukEUyYVvezb7/1YW22YfYM4Uyt8i173TGBGkRNHUMqQrcmYXI9l6smkwI07qt hGBA1Le4HV76oBiW3m8DxDzLpu0YfRVzRHrpopfP6Udg+v2HQ8KH2JS1iwmw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t= 1792681006; x=1792688206; bh=MX6+H6HoEBe+UOfH0T16WLp5b6MKq0eSYY5 BMOhvft0=; b=Tbq8bCmSp4kICVjHRdd3rRxIkKa/NHWTj/bPxFPPJAKTtgu0Sy6 F+Ogn5/fD82I8ckxZbj+3y71PAFG8NzkVXZnDE4ee1nOtXpkhF9IiX8zJh9CO0j/ euOzBA+H4eE5nc+B0YT/JK6soMeGkZAb5DfIBmPyVqFlFCL1lmf3hfZjUsVLsDPL Op60xdU0g44mPryeUIYg88xiV37C8RSWZvYAq/NbuIEVI4kaB8wo3eOBJaidxZMN Rws8mqF6ZA7U/2C/x60it85P5e6smrWTl0x/659bZjkGUCeGD3E/a1yzr+EwzZI/ fv7bA05rcLVCToYhIB4h4QpTSo9JmLsR7xA== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-07; repo=github.com/dkim2wg/interop; date=2026-10-18; sw=lmtpprox; action=sign d=kroah.com a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1792681006; d=kroah.com; mf=PGdyZWdAa3JvYWguY29tPg==; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm2:rsa-sha256:OCMhXD+O3vYqlBjH/6NfCEQw6gqjA6t3BnDbVNqndIyPMFb +Cp3fiHcaOnNPGho0cQLqbLwFTjfJW83jnpuR0bhdicPCyleiIk7q+75mpZExs0I nMtSklvFBjSMLwLP9d2o+/Zln4ywpXdsH232enZnEU4v0DwUu0SfXS01Wl210r9g ARaSiSA0YmDxnvQamUzzzLOogVks+NJm5B2WgwUT92m5DkWbZntU0WKNMBSN0Cj7 omNRuILgRyf/x34LmJ/VFYcem2DylDAUhAnkdjHdVTdyFSeAR18Z3wuSsV5ase8Y zg8aSr2r1tOZxOdJQkk63r1NOM6n9yvmYXoJmlQ==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-07; repo=github.com/dkim2wg/interop; date=2026-10-18; sw=lmtpprox; action=mi-m=1; hc=12; hn=cc,content-disposition,content-type,date,feedback-id,from, in-reply-to,message-id,mime-version,references,subject,to; Message-Instance: m=1; h=sha256:z2nn6qJapQB31p0KFDZyLR2mbNAVStuvCpCyDPrlsFs=:joggunysFwrxvOMY3aUgSttH3u2PCn9OlWS8Ris1zVc=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFfugBAqt0t1mXLA0jOd6hl0fNDx7CNpx9XZshTBhYyWscZbPZxzFsfEI9iqR/41e 5rEztA0HY05G54pzmQLtsl7yapPhUZdFZudXxPsKxsVvaQP1hUhvuydkZGgDWqqyGdNarM 0U2RKOGnZHludhI2nZHnwSYS8A3ofUoKiTTjxqmkizSTk1wMLzYwBFjeblqXzIj2KXQ7Nh 3ZvtqLIiTaP7cXg/FWntkgxuNE/b9EB+0Qk4Ts78MdsT8PeDHYJXUYiVx+3DtVjak91h5r FrRrutJBeW41MrPWDaTxghRmaGUQLePqvsndf51/HwS/AGdReZB3ogLoC4fkm5YuVvFikB YUN2/omvW7PkfCt1aMLRw6u1VoCVLoZPv0aPfF3E/cUHHWCDLGSnplcMtFkvBu9dNojcvx SpWPk6kAsZI+7uz7TEntkpkiwKebWJV8aToplf0kHLnMRaZ/dF3Uh4n96XlC0v5qnuJBcp XQShx3bnrqxylRnlc3qET1rtmtINcND8L/3kfQmEOU+wQhGgbLiffhpgMG3DQ5lS23hU2i MuiJek7ETaYVIlAi9u/V1AyeD0RHm7c09ub599nl2rfhJ0CXCufqUuI9H5FvU7NUeV/DJD 5dqHXVzwQIICdJyIExoctKEpFZ/lzl/RhSuLnvXumgvIjSiO9I7fjoMwXaYg X-ME-Proxy: Feedback-ID: i787e41f1:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 22 Oct 2026 10:56:45 -0400 (EDT) Date: Thu, 22 Oct 2026 16:56:37 +0200 From: Greg KH To: shaos Cc: jhs@mojatatu.com, Jiri Pirko , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, security@kernel.org Subject: Re: [BUG] net/sched: act_ife can emit uninitialized bytes for zero metadata Message-ID: <2026102244-cadillac-sworn-cee4@gregkh> References: <20261022144739.61342-1-shawnq1@163.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261022144739.61342-1-shawnq1@163.com> On Thu, Oct 22, 2026 at 02:47:39PM +0000, shaos wrote: > Hello, > > An attacker with only namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW installs a matchall IFE encode action carrying a zero-valued skb mark in a fresh user/network namespace. The presence callback reserves an 8-byte TLV, but the encoder emits no value bytes. The resulting frame contains six bytes from a freed kmalloc object previously populated by a different UID. You sent these all to public mailing lists, and you seem to have forgotten to include a patch for them? Please do so. thanks, greg k-h