diff options
| author |   Jakub Kicinski <kuba@kernel.org> | 2023-07-31 20:10:39 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2023-07-31 20:10:39 -0700 |
| commit | c5ccff70501d92db445a135fa49cf9bc6b98c444 (patch) | |
| tree | f4c5c3a4d75bf88d1e78c5aad27c156498b680a8 /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | octeon_ep: initialize mbox mutexes (diff) | |
| parent | net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (diff) | |
| download | wireguard-linux-c5ccff70501d92db445a135fa49cf9bc6b98c444.tar.xz wireguard-linux-c5ccff70501d92db445a135fa49cf9bc6b98c444.zip | |
Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route'
valis says:
====================
net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route
Three classifiers (cls_fw, cls_u32 and cls_route) always copy
tcf_result struct into the new instance of the filter on update.
This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.
This patch set fixes this issue in all affected classifiers by no longer
copying the tcf_result struct from the old filter.
====================
Link: https://lore.kernel.org/r/20230729123202.72406-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions