In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: use RCU with deferred freeing for action lifecycle

When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.

Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:

 0: mutex_lock() <-- holds the idr lock
 0: rcu_read_lock()
 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)
 0: mutex_unlock() <-- releases the idr lock
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index) <-- Action removed from IDR
 1: mutex_unlock() <-- mutex released allowing us to delete the action
 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory

This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu_head to tc_action used in the deferral and introducing a
call_rcu() in the delete path to defer the final kfree().

Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu")
but also modernization/simplification to directly use kfree_rcu().

Let's illustrate the new restored code path:

 0: rcu_read_lock()
 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
 1: idr_remove(idr, index)
 1: mutex_unlock()
 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period
 0: p = idr_find(idr, index)
 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0
 1: rcu_read_unlock() <-- release so freeing can run after grace period

After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.

https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835

https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2

https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305

https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113

https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009

https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7

https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3

https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/act_api.h","net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"98b2e40879abf0245be5a5b7af69e0f6ff524ac3","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"18af5d2ef0c4f65787fd1280c8b23286b9f2a835","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"1f1b98fea6b9ea30507d0f2fbff6750292d097e2","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"8b136f18ac4b2ace5aaad3305b3f8a5d8165a009","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"5dd51e09020c65aa53cf128e5e3517cd53b3c113","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"b60e9391142e983fab2be53497aa8f71fdd09cd5","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"91d105d2cbe002f9c7b43a6183adedc37e1da1f7","versionType":"git","status":"affected"},{"version":"d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da","lessThan":"5057e1aca011e51ef51498c940ef96f3d3e8a305","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/act_api.h","net/sched/act_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]