public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH net 1/2] net-shapers: clear hierarchy pointer and defer flush frees with RCU
@ 2026-03-09 17:35 Paul Moses
  2026-03-09 17:35 ` [PATCH net 2/2] net-shapers: don't free reply skb after genlmsg_reply() Paul Moses
                   ` (2 more replies)
  0 siblings, 3 replies; 13+ messages in thread
From: Paul Moses @ 2026-03-09 17:35 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni
  Cc: horms, jiri, netdev, linux-kernel, Paul Moses, stable

net_shaper_lookup() and the GET dump path traverse shaper state
under rcu_read_lock() without taking the shaper lock. During
teardown, net_shaper_flush() freed both the shapers and the
hierarchy with kfree(), but netdev->net_shaper_hierarchy still
pointed at the freed hierarchy.

This lets GET readers race netdevice teardown and walk freed
xarray state or freed shaper objects.

Detach the hierarchy pointer from the netdevice under the
shaper lock before teardown and switch the shaper and hierarchy
frees in flush to kfree_rcu().

Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
---
 net/shaper/shaper.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c
index 005bfc766e22d..3ad5a2d621a91 100644
--- a/net/shaper/shaper.c
+++ b/net/shaper/shaper.c
@@ -23,6 +23,7 @@
 
 struct net_shaper_hierarchy {
 	struct xarray shapers;
+	struct rcu_head rcu;
 };
 
 struct net_shaper_nl_ctx {
@@ -1352,23 +1353,28 @@ int net_shaper_nl_cap_get_dumpit(struct sk_buff *skb,
 
 static void net_shaper_flush(struct net_shaper_binding *binding)
 {
-	struct net_shaper_hierarchy *hierarchy = net_shaper_hierarchy(binding);
+	struct net_shaper_hierarchy *hierarchy;
 	struct net_shaper *cur;
 	unsigned long index;
 
-	if (!hierarchy)
+	net_shaper_lock(binding);
+	hierarchy = net_shaper_hierarchy(binding);
+	if (!hierarchy) {
+		net_shaper_unlock(binding);
 		return;
+	}
+
+	WRITE_ONCE(binding->netdev->net_shaper_hierarchy, NULL);
 
-	net_shaper_lock(binding);
 	xa_lock(&hierarchy->shapers);
 	xa_for_each(&hierarchy->shapers, index, cur) {
 		__xa_erase(&hierarchy->shapers, index);
-		kfree(cur);
+		kfree_rcu(cur, rcu);
 	}
 	xa_unlock(&hierarchy->shapers);
 	net_shaper_unlock(binding);
 
-	kfree(hierarchy);
+	kfree_rcu(hierarchy, rcu);
 }
 
 void net_shaper_flush_netdev(struct net_device *dev)
-- 
2.53.GIT



^ permalink raw reply related	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2026-03-16 23:59 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-09 17:35 [PATCH net 1/2] net-shapers: clear hierarchy pointer and defer flush frees with RCU Paul Moses
2026-03-09 17:35 ` [PATCH net 2/2] net-shapers: don't free reply skb after genlmsg_reply() Paul Moses
2026-03-11  2:28 ` [PATCH net 1/2] net-shapers: clear hierarchy pointer and defer flush frees with RCU Jakub Kicinski
2026-03-11 14:04   ` Paul Moses
2026-03-12  0:18     ` Jakub Kicinski
2026-03-12  6:05       ` Paul Moses
2026-03-12 14:25         ` Jakub Kicinski
2026-03-12 14:57           ` Paul Moses
2026-03-16 18:45   ` Paul Moses
2026-03-16 23:12     ` Jakub Kicinski
2026-03-16 23:41       ` Paul Moses
2026-03-16 23:59         ` Paul Moses
2026-03-11  2:40 ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox