Re: [PATCH v3] net/sched: fix use-after-free in taprio_dev_notifier

Simon Horman
2025-06-17T17:04:03Z

On Fri, Jun 13, 2025 at 08:54:57PM -0400, Hyunwoo Kim wrote:
> Since taprio’s taprio_dev_notifier() isn’t protected by an
> RCU read-side critical section, a race with advance_sched()
> can lead to a use-after-free.
>
> Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
>
> Fixes: fed87cc6718a ("net/sched: taprio: automatically calculate queueMaxSDU based on TC gate durations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
> Changes in v3:
> - Change so that taprio_set_picos_per_byte() is not included in the lock.
> - v2: https://lore.kernel.org/all/aEq3J4ODxH7x+neT@v4bel-B760M-AORUS-ELITE-AX/
>
> Changes in v2:
> - Add the appropriate tags.
> - v1: https://lore.kernel.org/all/aElUZyKy7x66X3SD@v4bel-B760M-AORUS-ELITE-AX/

Thanks for the update.

I agree that this is consistent with the review by Vladimir of v2.

Reviewed-by: Simon Horman <horms@kernel.org>

...