diff options
author | Paolo Abeni <pabeni@redhat.com> | 2023-08-01 11:47:28 +0300 |
---|---|---|
committer | Paolo Abeni <pabeni@redhat.com> | 2023-08-01 11:47:29 +0300 |
commit | 630e0afacd4beb8ad3081774169632b5b84e653d (patch) | |
tree | de2a6c904cdd372f1e23d5b80a764461024241ec /net/dsa | |
parent | 05e1d8bdb276068069d3de65e488700280029e20 (diff) | |
parent | e20e75017c5a3dbc4a3cc505d8ad57487b500bbb (diff) | |
download | linux-630e0afacd4beb8ad3081774169632b5b84e653d.tar.xz |
Merge branch 'net-sched-improve-class-lifetime-handling'
Pedro Tammela says:
====================
net/sched: improve class lifetime handling
Valis says[0]:
============
Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.
This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.
============
Turns out these could have been spotted easily with proper warnings.
Improve the current class lifetime with wrappers that check for
overflow/underflow.
While at it add an extack for when a class in use is deleted.
[0] https://lore.kernel.org/all/20230721174856.3045-1-sec@valis.email/
====================
Link: https://lore.kernel.org/r/20230728153537.1865379-1-pctammela@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/dsa')
0 files changed, 0 insertions, 0 deletions