* FAILED: patch "[PATCH] net/sched: cls_flower: avoid stale mask references after" failed to apply to 5.10-stable tree
@ 2026-11-03 10:09 gregkh
2026-11-03 15:47 ` [PATCH 5.10.y] net/sched: cls_flower: avoid stale mask references after delete Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: gregkh @ 2026-11-03 10:09 UTC (permalink / raw)
To: z1652074432, bird, kanolyc, kuba, n05ec; +Cc: stable
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 58f7989da6e715ce834ac861b7ba6ae9f9bdb098
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026110338-reassign-lapdog-d1ae@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 58f7989da6e715ce834ac861b7ba6ae9f9bdb098 Mon Sep 17 00:00:00 2001
From: Yuhang Zheng <z1652074432@gmail.com>
Date: Mon, 12 Oct 2026 09:07:19 +0800
Subject: [PATCH] net/sched: cls_flower: avoid stale mask references after
delete
Flower releases a mask reference when a filter is removed from the
classifier. The filter object can remain alive while dump, walk, or
hardware reoffload paths hold a reference to it. Those paths can then
dereference f->mask after the mask has already been released.
Keep the mask reference until the filter reference count reaches zero.
Release the mask synchronously from the final __fl_put() while the caller
still holds the tcf_proto reference, and leave the existing RCU work to
free the mask. This keeps the mask available to every reader that still
holds the filter.
The filter is still removed from the classifier indexes immediately.
Therefore, a deleted filter can temporarily retain an otherwise empty
mask; fl_delete() uses the handle IDR, rather than the mask list, to
determine whether the classifier has become empty.
Failed mask assignment can leave fnew->mask as an error or borrowed
pointer without an owned mask reference. Clear it before the common
failure path so the final put cannot release an unowned reference.
This fix does not add fields, snapshots, or per-filter memory.
Fixes: 92149190067d ("net: sched: flower: set unlocked flag for flower proto ops")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20261012010720.2248662-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 1cefea571efd..92a7f2d6efc0 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -518,15 +518,22 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f,
tcf_exts_hw_stats_update(&f->exts, &cls_flower.stats, cls_flower.use_act_stats);
}
-static void __fl_put(struct cls_fl_filter *f)
+static bool __fl_put(struct tcf_proto *tp, struct cls_fl_filter *f)
{
+ bool last = false;
+
if (!refcount_dec_and_test(&f->refcnt))
- return;
+ return false;
+
+ if (f->mask)
+ last = fl_mask_put(fl_head_dereference(tp), f->mask);
if (tcf_exts_get_net(&f->exts))
tcf_queue_work(&f->rwork, fl_destroy_filter_work);
else
__fl_destroy_filter(f);
+
+ return last;
}
static struct cls_fl_filter *__fl_get(struct cls_fl_head *head, u32 handle)
@@ -572,11 +579,10 @@ static int __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
list_del_rcu(&f->list);
spin_unlock(&tp->lock);
- *last = fl_mask_put(head, f->mask);
if (!tc_skip_hw(f->flags))
fl_hw_destroy_filter(tp, f, rtnl_held, extack);
tcf_unbind_filter(tp, &f->res);
- __fl_put(f);
+ *last = __fl_put(tp, f);
return 0;
}
@@ -617,7 +623,7 @@ static void fl_put(struct tcf_proto *tp, void *arg)
{
struct cls_fl_filter *f = arg;
- __fl_put(f);
+ __fl_put(tp, f);
}
static void *fl_get(struct tcf_proto *tp, u32 handle)
@@ -2488,12 +2494,14 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
}
err = fl_check_assign_mask(head, fnew, fold, mask);
- if (err)
+ if (err) {
+ fnew->mask = NULL;
goto unbind_filter;
+ }
err = fl_ht_insert_unique(fnew, fold, &in_ht);
if (err)
- goto errout_mask;
+ goto unbind_filter;
if (!tc_skip_hw(fnew->flags)) {
err = fl_hw_replace_filter(tp, fnew, rtnl_held, extack);
@@ -2547,7 +2555,6 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
spin_unlock(&tp->lock);
- fl_mask_put(head, fold->mask);
if (!tc_skip_hw(fold->flags))
fl_hw_destroy_filter(tp, fold, rtnl_held, NULL);
tcf_unbind_filter(tp, &fold->res);
@@ -2555,7 +2562,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
* after this.
*/
refcount_dec(&fold->refcnt);
- __fl_put(fold);
+ __fl_put(tp, fold);
} else {
idr_replace(&head->handle_idr, fnew, fnew->handle);
@@ -2580,9 +2587,6 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
if (in_ht)
rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
fnew->mask->filter_ht_params);
-errout_mask:
- fl_mask_put(head, fnew->mask);
-
unbind_filter:
if (bound_to_filter) {
if (flags & TCA_ACT_FLAGS_NO_RTNL)
@@ -2598,14 +2602,14 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
idr_remove(&head->handle_idr, fnew->handle);
spin_unlock(&tp->lock);
}
- __fl_put(fnew);
+ __fl_put(tp, fnew);
errout_tb:
kfree(tb);
errout_mask_alloc:
tcf_queue_work(&mask->rwork, fl_uninit_mask_free_work);
errout_fold:
if (fold)
- __fl_put(fold);
+ __fl_put(tp, fold);
return err;
}
@@ -2618,8 +2622,10 @@ static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
int err = 0;
err = __fl_delete(tp, f, &last_on_mask, rtnl_held, extack);
- *last = list_empty(&head->masks);
- __fl_put(f);
+ spin_lock(&tp->lock);
+ *last = idr_is_empty(&head->handle_idr);
+ spin_unlock(&tp->lock);
+ __fl_put(tp, f);
return err;
}
@@ -2641,12 +2647,12 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
rcu_read_unlock();
if (arg->fn(tp, f, arg) < 0) {
- __fl_put(f);
+ __fl_put(tp, f);
arg->stop = 1;
rcu_read_lock();
break;
}
- __fl_put(f);
+ __fl_put(tp, f);
arg->count++;
rcu_read_lock();
}
@@ -2697,7 +2703,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
cls_flower.rule =
flow_rule_alloc(tcf_exts_num_actions(&f->exts));
if (!cls_flower.rule) {
- __fl_put(f);
+ __fl_put(tp, f);
return -ENOMEM;
}
@@ -2715,7 +2721,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
if (err) {
kfree(cls_flower.rule);
if (tc_skip_sw(f->flags)) {
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
goto next_flow;
@@ -2731,11 +2737,11 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
kfree(cls_flower.rule);
if (err) {
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
next_flow:
- __fl_put(f);
+ __fl_put(tp, f);
}
return 0;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [PATCH 5.10.y] net/sched: cls_flower: avoid stale mask references after delete
2026-11-03 10:09 FAILED: patch "[PATCH] net/sched: cls_flower: avoid stale mask references after" failed to apply to 5.10-stable tree gregkh
@ 2026-11-03 15:47 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2026-11-03 15:47 UTC (permalink / raw)
To: stable
Cc: Yuhang Zheng, Xin Liu, Yucheng Lu, Ren Wei, Jakub Kicinski,
Sasha Levin
From: Yuhang Zheng <z1652074432@gmail.com>
[ Upstream commit 58f7989da6e715ce834ac861b7ba6ae9f9bdb098 ]
Flower releases a mask reference when a filter is removed from the
classifier. The filter object can remain alive while dump, walk, or
hardware reoffload paths hold a reference to it. Those paths can then
dereference f->mask after the mask has already been released.
Keep the mask reference until the filter reference count reaches zero.
Release the mask synchronously from the final __fl_put() while the caller
still holds the tcf_proto reference, and leave the existing RCU work to
free the mask. This keeps the mask available to every reader that still
holds the filter.
The filter is still removed from the classifier indexes immediately.
Therefore, a deleted filter can temporarily retain an otherwise empty
mask; fl_delete() uses the handle IDR, rather than the mask list, to
determine whether the classifier has become empty.
Failed mask assignment can leave fnew->mask as an error or borrowed
pointer without an owned mask reference. Clear it before the common
failure path so the final put cannot release an unowned reference.
This fix does not add fields, snapshots, or per-filter memory.
Fixes: 92149190067d ("net: sched: flower: set unlocked flag for flower proto ops")
Cc: stable@vger.kernel.org
Reported-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yucheng Lu <kanolyc@gmail.com>
Signed-off-by: Yuhang Zheng <z1652074432@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20261012010720.2248662-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ sashal: adapted error cleanup to use the existing errout label instead of unbind_filter ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_flower.c | 49 ++++++++++++++++++++++++------------------
1 file changed, 28 insertions(+), 21 deletions(-)
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 01d5903596aa0..2d6087f52340b 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -498,15 +498,22 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f,
cls_flower.stats.used_hw_stats_valid);
}
-static void __fl_put(struct cls_fl_filter *f)
+static bool __fl_put(struct tcf_proto *tp, struct cls_fl_filter *f)
{
+ bool last = false;
+
if (!refcount_dec_and_test(&f->refcnt))
- return;
+ return false;
+
+ if (f->mask)
+ last = fl_mask_put(fl_head_dereference(tp), f->mask);
if (tcf_exts_get_net(&f->exts))
tcf_queue_work(&f->rwork, fl_destroy_filter_work);
else
__fl_destroy_filter(f);
+
+ return last;
}
static struct cls_fl_filter *__fl_get(struct cls_fl_head *head, u32 handle)
@@ -543,11 +550,10 @@ static int __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
list_del_rcu(&f->list);
spin_unlock(&tp->lock);
- *last = fl_mask_put(head, f->mask);
if (!tc_skip_hw(f->flags))
fl_hw_destroy_filter(tp, f, rtnl_held, extack);
tcf_unbind_filter(tp, &f->res);
- __fl_put(f);
+ *last = __fl_put(tp, f);
return 0;
}
@@ -588,7 +594,7 @@ static void fl_put(struct tcf_proto *tp, void *arg)
{
struct cls_fl_filter *f = arg;
- __fl_put(f);
+ __fl_put(tp, f);
}
static void *fl_get(struct tcf_proto *tp, u32 handle)
@@ -2042,12 +2048,14 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
goto errout;
err = fl_check_assign_mask(head, fnew, fold, mask);
- if (err)
+ if (err) {
+ fnew->mask = NULL;
goto errout;
+ }
err = fl_ht_insert_unique(fnew, fold, &in_ht);
if (err)
- goto errout_mask;
+ goto errout;
if (!tc_skip_hw(fnew->flags)) {
err = fl_hw_replace_filter(tp, fnew, rtnl_held, extack);
@@ -2099,7 +2107,6 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
spin_unlock(&tp->lock);
- fl_mask_put(head, fold->mask);
if (!tc_skip_hw(fold->flags))
fl_hw_destroy_filter(tp, fold, rtnl_held, NULL);
tcf_unbind_filter(tp, &fold->res);
@@ -2107,7 +2114,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
* after this.
*/
refcount_dec(&fold->refcnt);
- __fl_put(fold);
+ __fl_put(tp, fold);
} else {
if (handle) {
/* user specifies a handle and it doesn't exist */
@@ -2152,17 +2159,15 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
if (in_ht)
rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
fnew->mask->filter_ht_params);
-errout_mask:
- fl_mask_put(head, fnew->mask);
errout:
- __fl_put(fnew);
+ __fl_put(tp, fnew);
errout_tb:
kfree(tb);
errout_mask_alloc:
tcf_queue_work(&mask->rwork, fl_uninit_mask_free_work);
errout_fold:
if (fold)
- __fl_put(fold);
+ __fl_put(tp, fold);
return err;
}
@@ -2175,8 +2180,10 @@ static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
int err = 0;
err = __fl_delete(tp, f, &last_on_mask, rtnl_held, extack);
- *last = list_empty(&head->masks);
- __fl_put(f);
+ spin_lock(&tp->lock);
+ *last = idr_is_empty(&head->handle_idr);
+ spin_unlock(&tp->lock);
+ __fl_put(tp, f);
return err;
}
@@ -2198,12 +2205,12 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
rcu_read_unlock();
if (arg->fn(tp, f, arg) < 0) {
- __fl_put(f);
+ __fl_put(tp, f);
arg->stop = 1;
rcu_read_lock();
break;
}
- __fl_put(f);
+ __fl_put(tp, f);
arg->count++;
rcu_read_lock();
}
@@ -2254,7 +2261,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
cls_flower.rule =
flow_rule_alloc(tcf_exts_num_actions(&f->exts));
if (!cls_flower.rule) {
- __fl_put(f);
+ __fl_put(tp, f);
return -ENOMEM;
}
@@ -2272,7 +2279,7 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
kfree(cls_flower.rule);
if (tc_skip_sw(f->flags)) {
NL_SET_ERR_MSG_MOD(extack, "Failed to setup flow action");
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
goto next_flow;
@@ -2288,11 +2295,11 @@ static int fl_reoffload(struct tcf_proto *tp, bool add, flow_setup_cb_t *cb,
kfree(cls_flower.rule);
if (err) {
- __fl_put(f);
+ __fl_put(tp, f);
return err;
}
next_flow:
- __fl_put(f);
+ __fl_put(tp, f);
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-03 15:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-03 10:09 FAILED: patch "[PATCH] net/sched: cls_flower: avoid stale mask references after" failed to apply to 5.10-stable tree gregkh
2026-11-03 15:47 ` [PATCH 5.10.y] net/sched: cls_flower: avoid stale mask references after delete Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox