Re: [PATCH v3] net/sched: fix use-after-free in taprio_dev_notifier

Eric Dumazet
2025-06-17T17:35:51Z

On Fri, Jun 13, 2025 at 5:55 PM Hyunwoo Kim <imv4bel@gmail.com> wrote:
>
> Since taprio’s taprio_dev_notifier() isn’t protected by an
> RCU read-side critical section, a race with advance_sched()
> can lead to a use-after-free.
>
> Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
>
> Fixes: fed87cc6718a ("net/sched: taprio: automatically calculate queueMaxSDU based on TC gate durations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---

Reviewed-by: Eric Dumazet <edumazet@google.com>