Skip to content
Commit 630e0afa authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge branch 'net-sched-improve-class-lifetime-handling'

Pedro Tammela says:

====================
net/sched: improve class lifetime handling

Valis says[0]:
============
Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.
============

Turns out these could have been spotted easily with proper warnings.
Improve the current class lifetime with wrappers that check for
overflow/underflow.

While at it add an extack for when a class in use is deleted.

[0] https://lore.kernel.org/all/20230721174856.3045-1-sec@valis.email/
====================

Link: https://lore.kernel.org/r/20230728153537.1865379-1-pctammela@mojatatu.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents 05e1d8bd e20e7501
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment