From: Paolo Abeni Date: Tue, 1 Aug 2023 08:47:28 +0000 (+0200) Subject: Merge branch 'net-sched-improve-class-lifetime-handling' X-Git-Tag: microblaze-v6.8~638^2~276 X-Git-Url: http://git.monstr.eu/?a=commitdiff_plain;h=630e0afacd4beb8ad3081774169632b5b84e653d;p=linux-2.6-microblaze.git Merge branch 'net-sched-improve-class-lifetime-handling' Pedro Tammela says: ==================== net/sched: improve class lifetime handling Valis says[0]: ============ Three classifiers (cls_fw, cls_u32 and cls_route) always copy tcf_result struct into the new instance of the filter on update. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. ============ Turns out these could have been spotted easily with proper warnings. Improve the current class lifetime with wrappers that check for overflow/underflow. While at it add an extack for when a class in use is deleted. [0] https://lore.kernel.org/all/20230721174856.3045-1-sec@valis.email/ ==================== Link: https://lore.kernel.org/r/20230728153537.1865379-1-pctammela@mojatatu.com Signed-off-by: Paolo Abeni --- 630e0afacd4beb8ad3081774169632b5b84e653d