Re: [PATCH net 0/3] net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route

[Paolo Abeni <pabeni@redhat.com>]

Hi,

On Fri, 2023-07-21 at 17:48 +0000, valis wrote:
> Three classifiers (cls_fw, cls_u32 and cls_route) always copy 
> tcf_result struct into the new instance of the filter on update.
> 
> This causes a problem when updating a filter bound to a class,
> as tcf_unbind_filter() is always called on the old instance in the 
> success path, decreasing filter_cnt of the still referenced class 
> and allowing it to be deleted, leading to a use-after-free.
> 
> This patch set fixes this issue in all affected classifiers by no longer
> copying the tcf_result struct from the old filter.
> 
> valis (3):
>   net/sched: cls_u32: No longer copy tcf_result on update to avoid
>     use-after-free
>   net/sched: cls_fw: No longer copy tcf_result on update to avoid
>     use-after-free
>   net/sched: cls_route: No longer copy tcf_result on update to avoid
>     use-after-free

The SoB in used here sounds really like a pseudonym, which in turn is
not explicitly forbidden by the the process, but a is IMHO a bit
borderline:

https://elixir.bootlin.com/linux/v6.4.5/source/Documentation/process/submitting-patches.rst#L415

@valis: could you please re-submit this using your a more
identificative account? You can retain the already collected acks.

Thanks!

Paolo
> 
>  net/sched/cls_fw.c    | 1 -
>  net/sched/cls_route.c | 1 -
>  net/sched/cls_u32.c   | 1 -
>  3 files changed, 3 deletions(-)
>