| Message ID | 20240903140708.3122263-2-dmantipov@yandex.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v4,1/3] net: sched: fix use-after-free in taprio_change() | expand |
On Tue, Sep 03, 2024 at 05:07:07PM +0300, Dmitry Antipov wrote: > According to Vinicius (and carefully looking through the whole thing > once again), txtime branch of 'taprio_change()' is not going to race > against 'advance_sched()'. But using 'rcu_replace_pointer()' in the > former may be a good idea as well. Hi Dmitry, If this is not a fix, then it should be targeted at net-next. As the other two patches in the series do appear to be fixes, that means the patch-set should be split into two: one for net and one for net-next. Also, please consider including a cover letter with patch-sets with more than one patch. > Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> > Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> > --- > v4: adjust subject to target net tree > v3: unchanged since v2 > v2: added to the series ...
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 59fad74d5ff9..9f4e004cdb8b 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -1952,7 +1952,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, goto unlock; } - rcu_assign_pointer(q->admin_sched, new_admin); + /* Not going to race against advance_sched(), but still */ + admin = rcu_replace_pointer(q->admin_sched, new_admin, + lockdep_rtnl_is_held()); if (admin) call_rcu(&admin->rcu, taprio_free_sched_cb); } else {
According to Vinicius (and carefully looking through the whole thing once again), txtime branch of 'taprio_change()' is not going to race against 'advance_sched()'. But using 'rcu_replace_pointer()' in the former may be a good idea as well. Suggested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- v4: adjust subject to target net tree v3: unchanged since v2 v2: added to the series --- net/sched/sch_taprio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)