Re: [PATCH v1] net/sched: sch_qfq: Fix race condition on qfq_aggregate

[Cong Wang <xiyou.wangcong@gmail.com>]

On Sat, Jul 05, 2025 at 03:39:58PM -0700, Xiang Mei wrote:
> A race condition can occur when 'agg' is modified in qfq_change_agg
> (called during qfq_enqueue) while other threads access it
> concurrently. For example, qfq_dump_class may trigger a NULL
> dereference, and qfq_delete_class may cause a use-after-free.
> 
> This patch addresses the issue by:
> 
> 1. Moved qfq_destroy_class into the critical section.
> 
> 2. Added sch_tree_lock protection to qfq_dump_class and
> qfq_dump_class_stats.
> 
> Signed-off-by: Xiang Mei <xmei5@asu.edu>

Although holding sch_tree_lock() for control path is generally not
elegant, this is clearly not your fault, the current code is already so.
Converting to RCU requires more efforts, so it should be deferred to
long term (net-next).

So as a bug fix, this patch is okay.

Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>

(I assume you tested it with all tdc selftests.)

Thanks!