Reported by shaos with a reproducer for the 32-bit case, which was reproduced and verified in our test environment. The issue: ife_check_meta_u32() and ife_check_meta_u16() both reserve eight bytes of metadata for a configured value even when that value is zero, but the matching encoder returns without calling ife_tlv_meta_encode(). The encoder therefore writes neither the TLV header nor its value, while the enclosing IFE length still includes the reserved bytes, exposing stale skb headroom contents to the peer. The 32-bit helper has been present since the IFE action was introduced (v4.6); the 16-bit helper was added with the 16-bit metadata helpers used by the skbtcindex callback (v4.9). Both defects predate the oldest supported stable kernel (5.10), so they are fixed together in this patch. Each hunk keeps its own Fixes: tag for provenance. The fix: Encode any configured value, including zero; skip the TLV only when there is neither a configured nor a runtime value. The runtime fallback is unchanged. A raw TCA_IFE_METALST netlink request is needed to express the configured zero: the IFE_META_SKBMARK attribute carries four zero payload bytes for the u32 helper, and IFE_META_TCINDEX two zero payload bytes for the 16-bit helper (not an absent or zero-length attribute). Stock tc cannot build these requests; "use mark 0x0" emits no mark attribute and "allow mark" emits a zero-length one. Conditions to recreate the bug: CONFIG_NET_ACT_IFE=y, CONFIG_NET_IFE_SKBMARK=y, CONFIG_NET_IFE_SKBTCINDEX=y, CONFIG_NET_CLS_MATCHALL=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y, CONFIG_VETH=y. In a fresh user and network namespace create a veth pair and attach clsact to the egress side. Install a matchall filter whose ife encode action carries a zero skb mark (or a zero tcindex) in TCA_IFE_METALST. Send a frame through the veth and inspect the IFE metadata in the received frame. The metadata region is eight bytes but holds neither a valid TLV header nor a value; it exposes prior headroom contents. Setting the value to a nonzero one does not trigger the leak. The namespace needs CAP_NET_ADMIN; no additional privilege is required. With the fix the zero TLVs are 0001000800000000 (u32) and 0005000600000000 (u16). Fixes: ef6980b6becb ("introduce IFE action") Fixes: 6a5d58b67e20 ("net sched ife action: add 16 bit helpers") Reported-by: shaos Link: https://lore.kernel.org/netdev/20261022144739.61342-1-shawnq1@163.com/ Cc: stable@vger.kernel.org Signed-off-by: Jamal Hadi Salim --- net/sched/act_ife.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 3946a9589bb8..6b23a3965121 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -50,8 +50,7 @@ int ife_encode_meta_u16(u16 metaval, void *skbdata, struct tcf_meta_info *mi) edata = *(u16 *)mi->metaval; else if (metaval) edata = metaval; - - if (!edata) /* will not encode */ + else return 0; edata = htons(edata); @@ -94,8 +93,7 @@ int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi) edata = *(u32 *)mi->metaval; else if (metaval) edata = metaval; - - if (!edata) /* will not encode */ + else return 0; edata = htonl(edata); -- 2.43.0