From: Simon Horman <horms@kernel.org>
To: Pedro Tammela <pctammela@mojatatu.com>
Cc: netdev@vger.kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, jhs@mojatatu.com,
xiyou.wangcong@gmail.com, jiri@resnulli.us
Subject: Re: [PATCH net-next v2 0/5] net/sched: improve class lifetime handling
Date: Mon, 31 Jul 2023 09:31:42 +0200 [thread overview]
Message-ID: <ZMdjXqxsgWwBOeKy@kernel.org> (raw)
In-Reply-To: <20230728153537.1865379-1-pctammela@mojatatu.com>
On Fri, Jul 28, 2023 at 12:35:32PM -0300, Pedro Tammela wrote:
> Valis says[0]:
> ============
> Three classifiers (cls_fw, cls_u32 and cls_route) always copy
> tcf_result struct into the new instance of the filter on update.
>
> This causes a problem when updating a filter bound to a class,
> as tcf_unbind_filter() is always called on the old instance in the
> success path, decreasing filter_cnt of the still referenced class
> and allowing it to be deleted, leading to a use-after-free.
> ============
>
> Turns out these could have been spotted easily with proper warnings.
> Improve the current class lifetime with wrappers that check for
> overflow/underflow.
>
> While at it add an extack for when a class in use is deleted.
>
> [0] https://lore.kernel.org/all/20230721174856.3045-1-sec@valis.email/
>
> v1 -> v2:
> - Add ack tag from Jamal
> - Move definitions to sch_generic.h as suggested by Cong
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2023-07-31 7:31 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-28 15:35 [PATCH net-next v2 0/5] net/sched: improve class lifetime handling Pedro Tammela
2023-07-28 15:35 ` [PATCH net-next v2 1/5] net/sched: wrap open coded Qdics class filter counter Pedro Tammela
2023-07-28 15:35 ` [PATCH net-next v2 2/5] net/sched: sch_drr: warn about class in use while deleting Pedro Tammela
2023-07-28 15:35 ` [PATCH net-next v2 3/5] net/sched: sch_hfsc: " Pedro Tammela
2023-07-28 15:35 ` [PATCH net-next v2 4/5] net/sched: sch_htb: " Pedro Tammela
2023-07-28 15:35 ` [PATCH net-next v2 5/5] net/sched: sch_qfq: " Pedro Tammela
2023-07-31 7:31 ` Simon Horman [this message]
2023-08-01 9:10 ` [PATCH net-next v2 0/5] net/sched: improve class lifetime handling patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZMdjXqxsgWwBOeKy@kernel.org \
--to=horms@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pctammela@mojatatu.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.