[PATCH net] net/sched: cls_u32: take a reference on the hash table in u32_change()

[Norbert Szetei <norbert@doyensec.com>]

u32_change() keeps the target hash table in a local variable without
taking a reference. u32_set_parms() may then drop rtnl to load an action
module, and on a failed load returns without asking the caller to
replay (-ENOENT). A concurrent RTM_DELTFILTER can free the table in
that window, and u32_change() then removes the node id it reserved from
the freed table.

Take a reference on the table across u32_set_parms(). A racing
u32_delete() then fails its refcount_dec_if_one() and returns -EBUSY
instead of freeing it.

Fixes: e7614370d6f0 ("net_sched: use idr to allocate u32 filter handles")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
---
Reproducer available on request.

 net/sched/cls_u32.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index a3e65c8cf29e..0e9128f2f33e 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -1180,8 +1180,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
 	}
 #endif
 
+	/* u32_set_parms() may drop rtnl; keep ht alive across it */
+	refcount_inc(&ht->refcnt);
 	err = u32_set_parms(net, tp, n, tb, tca[TCA_RATE],
 			    flags, n->flags, extack);
+	refcount_dec(&ht->refcnt);
 
 	u32_bind_filter(tp, n, base, tb);
 
-- 
2.55.0