Re: [PATCH v2] net/sched: fix use-after-free in taprio_dev_notifier

[Vladimir Oltean <vladimir.oltean@nxp.com>]

On Thu, Jun 12, 2025 at 01:23:38PM -0700, Cong Wang wrote:
> On Thu, Jun 12, 2025 at 07:16:55AM -0400, Hyunwoo Kim wrote:
> > diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
> > index 14021b812329..bd2b02d1dc63 100644
> > --- a/net/sched/sch_taprio.c
> > +++ b/net/sched/sch_taprio.c
> > @@ -1320,6 +1320,7 @@ static int taprio_dev_notifier(struct notifier_block *nb, unsigned long event,
> >  	if (event != NETDEV_UP && event != NETDEV_CHANGE)
> >  		return NOTIFY_DONE;
> >  
> > +	rcu_read_lock();
> >  	list_for_each_entry(q, &taprio_list, taprio_list) {
> >  		if (dev != qdisc_dev(q->root))
> >  			continue;
> > @@ -1328,16 +1329,17 @@ static int taprio_dev_notifier(struct notifier_block *nb, unsigned long event,
> 
> There is a taprio_set_picos_per_byte() call here, it calls
> __ethtool_get_link_ksettings() which could be blocking.
> 
> For instance, gve_get_link_ksettings() calls
> gve_adminq_report_link_speed() which is a blocking function.
> 
> So I am afraid we can't enforce an atomic context here.
> 
> Sorry.
> Cong

Yeah, and phylib's phy_ethtool_ksettings_get() acquires the
&phydev->lock mutex, which is sleepable. Agreed that this won't work,
good catch.