Merge branch 'net-sched-improve-class-lifetime-handling'

Browse source

Pedro Tammela says:

====================
net/sched: improve class lifetime handling

Valis says[0]:
============
Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.
============

Turns out these could have been spotted easily with proper warnings.
Improve the current class lifetime with wrappers that check for
overflow/underflow.

While at it add an extack for when a class in use is deleted.

[0] https://lore.kernel.org/all/20230721174856.3045-1-sec@valis.email/
====================

Link: https://lore.kernel.org/r/20230728153537.1865379-1-pctammela@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

...

This commit is contained in:

Paolo Abeni 2023-08-01 10:47:28 +02:00

parent 05e1d8bdb2 e20e75017c

commit 630e0afacd

5 changed files with 49 additions and 20 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

26

include/net/sch_generic.h

View file

11

net/sched/sch_drr.c

View file

10

net/sched/sch_hfsc.c

View file

10

net/sched/sch_htb.c

View file

12

net/sched/sch_qfq.c

View file