Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 09B5C37BE6F; Thu, 20 Aug 2026 17:42:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247749; cv=none; b=K+nJCwhBHUF8/YW42HLDkXW4YMST8ktLQMhbCO8hn/CKZk2Bvsd8UDq4A6u7+RhwWM1BjNhfKm95Y9t7KEOTivADFIL03dGMO0oOms+JblwTLt+RN0vsQtKUwCDwLph4m8C358BxSJNZJZ2pShOnr9nQLgjvLoM3EYQiukWSg3M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787247749; c=relaxed/simple; bh=S08f/CDpdx4SljqZcXtWu2Tvmud8JH0MGvZ7mbVNeLA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=c1M5Jbyk4PwvnW51RS9o4dlZwVsvOcEiAhmIy9K/eWeUPvWHQ78tp9ezPcf5KzFdSyaI/UcpXGHQZ0dH6Fx8/wYfpmCD4Wl7GeMHf5TCAKSmh+UKcHqBNxu5Q/J5QXSJMx0tMxZP4LzMp/cGetXNg6dLX9kSJtQSIyUrhBU50Sg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yhEn4cYG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yhEn4cYG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65CB61F000E9; Thu, 20 Aug 2026 17:42:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787247747; bh=3zmjRwv5TuKoRvl6kHhlKwnt8CLrrKcudA+68u1sPt0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=yhEn4cYGjh/WVL7Sfdf/ewdtKlDal1JePf+vntYzsOrvo8FcqE8obgSPQzIfD5F6Y WlWngbcL4zwL7Y/eqUyaX3wQz+kziGgbgDsD1ZTEjrHqY5X2T9EKdTmqjL1sAoMPuf FKAnXMVZLzPdTsC4eFTrQD8UCIRw0bL/cOlBDIjc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Victor Nogueira , Daniel Borkmann , Simon Horman , "David S. Miller" , Sasha Levin Subject: [PATCH 6.6 154/166] net: sched: Move drop_reason to struct tc_skb_cb Date: Thu, 20 Aug 2026 16:56:53 +0200 Message-ID: <20260820145215.800679823@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820145211.194104353@linuxfoundation.org> References: <20260820145211.194104353@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Victor Nogueira [ Upstream commit fb2780721ca5e9f78bbe4544b819b929a982df9c ] Move drop_reason from struct tcf_result to skb cb - more specifically to struct tc_skb_cb. With that, we'll be able to also set the drop reason for the remaining qdiscs (aside from clsact) that do not have access to tcf_result when time comes to set the skb drop reason. Signed-off-by: Victor Nogueira Acked-by: Daniel Borkmann Reviewed-by: Simon Horman Signed-off-by: David S. Miller Stable-dep-of: f60b396ee174 ("net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain") Signed-off-by: Sasha Levin --- include/net/pkt_cls.h | 14 ++++++++++++-- include/net/pkt_sched.h | 3 ++- include/net/sch_generic.h | 1 - net/core/dev.c | 4 ++-- net/sched/act_api.c | 2 +- net/sched/cls_api.c | 23 ++++++++--------------- 6 files changed, 25 insertions(+), 22 deletions(-) diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h index 253bd199d8648..325a8553853df 100644 --- a/include/net/pkt_cls.h +++ b/include/net/pkt_cls.h @@ -163,10 +163,20 @@ __cls_set_class(unsigned long *clp, unsigned long cl) return xchg(clp, cl); } -static inline void tcf_set_drop_reason(struct tcf_result *res, +struct tc_skb_cb; + +static inline struct tc_skb_cb *tc_skb_cb(const struct sk_buff *skb); + +static inline enum skb_drop_reason +tcf_get_drop_reason(const struct sk_buff *skb) +{ + return tc_skb_cb(skb)->drop_reason; +} + +static inline void tcf_set_drop_reason(const struct sk_buff *skb, enum skb_drop_reason reason) { - res->drop_reason = reason; + tc_skb_cb(skb)->drop_reason = reason; } static inline void diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h index 4d72d24b1f33e..9b5698b86986c 100644 --- a/include/net/pkt_sched.h +++ b/include/net/pkt_sched.h @@ -276,12 +276,13 @@ static inline void skb_txtime_consumed(struct sk_buff *skb) struct tc_skb_cb { struct qdisc_skb_cb qdisc_cb; + u32 drop_reason; + u16 zone; /* Only valid if post_ct = true */ u16 mru; u8 post_ct:1; u8 post_ct_snat:1; u8 post_ct_dnat:1; - u16 zone; /* Only valid if post_ct = true */ }; static inline struct tc_skb_cb *tc_skb_cb(const struct sk_buff *skb) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index ac09063bcd92a..4a157ab9a724f 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -334,7 +334,6 @@ struct tcf_result { }; const struct tcf_proto *goto_tp; }; - enum skb_drop_reason drop_reason; }; struct tcf_chain; diff --git a/net/core/dev.c b/net/core/dev.c index 3fe9e6b60d4f5..5c1c5644d9041 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4046,14 +4046,14 @@ static int tc_run(struct tcx_entry *entry, struct sk_buff *skb, tc_skb_cb(skb)->mru = 0; tc_skb_cb(skb)->post_ct = false; - res.drop_reason = *drop_reason; + tcf_set_drop_reason(skb, *drop_reason); mini_qdisc_bstats_cpu_update(miniq, skb); ret = tcf_classify(skb, miniq->block, miniq->filter_list, &res, false); /* Only tcf related quirks below. */ switch (ret) { case TC_ACT_SHOT: - *drop_reason = res.drop_reason; + *drop_reason = tcf_get_drop_reason(skb); mini_qdisc_qstats_cpu_drop(miniq); break; case TC_ACT_OK: diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 4bf82e6d9d422..c5a3f316d0de4 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -1118,7 +1118,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions, } } else if (TC_ACT_EXT_CMP(ret, TC_ACT_GOTO_CHAIN)) { if (unlikely(!rcu_access_pointer(a->goto_chain))) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } tcf_action_goto_chain_exec(a, res); diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 3b545296d4482..841360e07d7aa 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -1708,7 +1708,6 @@ static inline int __tcf_classify(struct sk_buff *skb, int act_index, u32 *last_executed_chain) { - u32 orig_reason = res->drop_reason; #ifdef CONFIG_NET_CLS_ACT const int max_reclassify_loop = 16; const struct tcf_proto *first_tp; @@ -1733,13 +1732,13 @@ static inline int __tcf_classify(struct sk_buff *skb, */ if (unlikely(n->tp != tp || n->tp->chain != n->chain || !tp->ops->get_exts)) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } exts = tp->ops->get_exts(tp, n->handle); if (unlikely(!exts || n->exts != exts)) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } @@ -1763,18 +1762,12 @@ static inline int __tcf_classify(struct sk_buff *skb, goto reset; } #endif - if (err >= 0) { - /* Policy drop or drop reason is over-written by - * classifiers with a bogus value(0) */ - if (err == TC_ACT_SHOT && - res->drop_reason == SKB_NOT_DROPPED_YET) - tcf_set_drop_reason(res, orig_reason); + if (err >= 0) return err; - } } if (unlikely(n)) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } @@ -1786,7 +1779,7 @@ static inline int __tcf_classify(struct sk_buff *skb, tp->chain->block->index, tp->prio & 0xffff, ntohs(tp->protocol)); - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } @@ -1824,7 +1817,7 @@ int tcf_classify(struct sk_buff *skb, n = tcf_exts_miss_cookie_lookup(ext->act_miss_cookie, &act_index); if (!n) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } @@ -1835,7 +1828,7 @@ int tcf_classify(struct sk_buff *skb, fchain = tcf_chain_lookup_rcu(block, chain); if (!fchain) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } @@ -1857,7 +1850,7 @@ int tcf_classify(struct sk_buff *skb, ext = tc_skb_ext_alloc(skb); if (WARN_ON_ONCE(!ext)) { - tcf_set_drop_reason(res, SKB_DROP_REASON_TC_ERROR); + tcf_set_drop_reason(skb, SKB_DROP_REASON_TC_ERROR); return TC_ACT_SHOT; } -- 2.53.0