Re: [PATCH net v2 1/1] net/sched: cls_flower: avoid stale mask references after delete

[Paolo Abeni <pabeni@redhat.com>]

On 4/23/26 8:51 PM, Jakub Kicinski wrote:
> On Wed, 22 Apr 2026 00:03:02 +0800 Ren Wei wrote:
>> From: Yuhang Zheng <z1652074432@gmail.com>
>>
>> cls_flower keeps filter and mask state separately. After a filter is
>> removed or replaced, some paths can still need the mask data associated
>> with that filter.
>>
>> Cache the mask key and dissector in struct cls_fl_filter when the mask
>> is assigned, and use the cached copies in dump and offload paths. This
>> avoids depending on the external mask object's lifetime after delete or
>> replace.
>>
>> Fixes: 92149190067d ("net: sched: flower: set unlocked flag for flower proto ops")
>> Cc: stable@kernel.org
>> Reported-by: Yuan Tan <yuantan098@gmail.com>
>> Reported-by: Yifan Wu <yifanwucs@gmail.com>
>> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
>> Reported-by: Xin Liu <bird@lzu.edu.cn>
>> Tested-by: Yucheng Lu <kanolyc@gmail.com>
>> Signed-off-by: Yuhang Zheng <z1652074432@gmail.com>
>> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
> 
> Jiri, do you have an opinion? Feels slightly wasteful (as sashiko points
> out), IDK if there's a cleaner fix.

I agree we should try hard to avoid the considerable struct
cls_fl_filter size increase.

Would be possible to move the fl_mask_put() into __fl_put, after the
rfcount decrement?!?

Or possibly would be less invasive to set the fd->mask to NULL in
__fl_delete() under the tp->lock, and explicitly check for NULL ptr in
before access (AFAICS, each access is under tp->lock).

/P