AZL-97143

In the Linux kernel, the following vulnerability has been resolved:

net/sched: actgact, actpolice: range check the fallback control action

tcfactioncheck_ctrlact() range checks the primary control action:

if (!opcode)
    ret = action > TC_ACT_VALUE_MAX ? -EINVAL : 0;

TCACTVALUEMAX is TCACTTRAP, so kernel-internal verdicts above it cannot be set that way. But actgact and actpolice each carry a second, independent control action supplied by user space that never reaches that helper - TCAGACTPROB.paction and TCAPOLICERESULT. Both only reject TCACTGOTOCHAIN, so any other value is stored verbatim and returned verbatim from the action.

In particular user space can store TCACTCONSUMED, which is TCACTVALUEMAX + 1 and is deliberately not part of the UAPI value range. That verdict tells every caller the action took ownership of the skb, so nobody frees it: schhandleingress(), schhandleegress() and tcfqeventhandle() all deliberately skip the free for it. The result is one leaked skbuff plus its data buffer per packet traversing the filter, unbounded, for all traffic on the chain including kernel-generated packets.

Both are trivially deterministic. actgact clamps tcfgpval to >= 1, so with pval = 1 gactdeterm() returns the fallback for every packet. actpolice has no mandatory rate, so rate = 0 leaves tcfpmtu = ~0 and tcfpolicemtucheck() always passes.

TCACTCONSUMED was added by commit 720f22fed81b ("net: sched: refactor reinsert action"), after both goto-chain guards were written: commit 9469f375ab09 ("net/sched: actgact: disallow 'goto chain' on fallback control action") and commit c08f5ed5d625 ("net/sched: actpolice: disallow 'goto chain' on fallback control action"). Neither guard was widened when the new verdict appeared.

Factor the existing range test out of tcfactioncheckctrlact() as tcfactionvalid() and apply it to both fallbacks. The helper cannot call tcfactioncheckctrlact() directly because that also allocates a goto_chain, which is exactly what these two sites must not do.

Reproduced on v7.2-rc6: kmemleak reports one leaked 232-byte skbuffheadcache object plus its 704-byte data buffer per packet. With this patch both configurations are rejected with -EINVAL and kmemleak reports none.