From nobody Thu Apr 2 12:33:35 2026 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8EFB633C51A for ; Sat, 28 Mar 2026 18:58:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774724300; cv=none; b=MBNKHEfu//MY/7tn2e4Peu8bWF4Oi1hVR2wEUVJn256q/GOjvJxGFSUOQNSx5bosayTsovy/ApzvBjMakK5PMcRM5rlUd8xECkVnGSwu+24Qn1ttgEbwMJ2nPxJDU9VBulfROUweQWLCv78TX0Rs37ffkI4FmdMNff4HFTZu/oY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774724300; c=relaxed/simple; bh=TY2hsxKzRdg6cVTU5tH32Ru8fM1l3UVUUf+AIaD3Bug=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l7+WrDVZ4Ih/Je+ktB4BtqYZkpwV3QYouoOTTs+yDwy4S7BZyZERRxjvKyf/3fgrN5yNnDGxecSuTUxUlML9h+WeF7xqdYp9sggAnlmth+jl3NQia478JKovSknoBrdL7zun8BRtd0sFYmhoIU4CLNcSUDYCCbbQvJiJN6s46cY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Q277r79J; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Q277r79J" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2b042533de1so18055095ad.0 for ; Sat, 28 Mar 2026 11:58:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774724298; x=1775329098; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=PWZCRNA7sq5TKfV/GxwqqTIp6ycx6O3DA7KXt4hfRiQ=; b=Q277r79J2yZ72Kx3XeYpKwiAmpKOu5ZxmDkdQHGCpWeB/U4KM9bFEacDl3NhhJedP9 cSv74bT9JjdVkMhYsD4siNtHJIqKbH+OLQ3USw7O6ZzuFOLBfnGH5wcOG2q50FkXUNSv cHu22HlJkUYGk0tkhu9AxKgAaFI24r6G4Y/86QtdwY8taK4rwiNSo9Jb+JTZ91WpY5J+ g2CdF0qlzb6hWuYqZ8JvZy3X2fQmLJTy4z5PF66grPDOMx4LFM23I9IfIoNJ0U+8JWvZ ZVnjBmL9pQ/DJlG8UOvN50VyJHjKZ+FUsDMC91XX2wBrLbaJs4qUD03INcODD1lBKeX8 /r3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774724298; x=1775329098; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=PWZCRNA7sq5TKfV/GxwqqTIp6ycx6O3DA7KXt4hfRiQ=; b=NBBF+pXgWMOOCs1jvS0PfR5ecHffGJGOPjovZN6BPAuz5JAecOHdQNqi8AoCF5/LUb lDr77ZlU3AX/RthQ7VvS5uC2jFz8Rqp4e/BjOyQo6eYf6gnLCuPrCkdbTIQyR6bDmIYs bscTqP9e00B+NERqFaNdv6SdxVUpVnKEIEL6PxIsUEeE/4jtch7X4o/WMnu9mD2Y9ad3 C+UDjtfuRoO6Gq60aaMAaxFrGucaqzaP4F3X/NG4gSdiaSGPF82iwQj+PZSFrQfoJnFR KNIkSh+GaLsmmPPqbYpkfBpJ0Z8rlexdlqfxuImymyKBHIiReBsO5Xh3PjEpbs1DyoBx 7PAw== X-Forwarded-Encrypted: i=1; AJvYcCUeyDVsG6mlipbvCk59EKFN9eyp83ubJMAhsFcjcDezJboqeRMB5PWsiRoxRzat8sePPDfFpSn2zaJvFLU=@vger.kernel.org X-Gm-Message-State: AOJu0YzGegbOr21thxSxXxvECGJhfMPDf+d+ms9W1xq2MHeEaWoV4yjR 5dsPcKJaw7r+/V9NEdoi4qycSq34l0184k36LhHLcvGjx7pf/aVu6WqPA2oeEYmzKrw+5w== X-Gm-Gg: ATEYQzwvyglIC6T2OKGj4Q8BzGwaMWKfGcUf3pfyIC7bf2yVJaCYAuxQY4RWD59Z+PS cxg1zuBJH0vf4axx9Q+2OHiUN+F1RJYQ/qpl0uyPA2wYMH0CwFn6djBhVe9ioAJUi3Vsv07aZvY eQbqxLGMXoKdBr/eT6CnIGX14EF55XdG96ZF+F6aJvEMSjeOUel35JmCKaEsF3tcbVTgfbuh7W6 DsJs211zCq8dkTmpSRpYZV71uq+rrjcIOdojjQySa10DiVsFcCUbZ4hRNZGkbfFzTu7uCR/8XRm hqX2dPqbE77J8qlkrEN9FT7Qg6kD63S7l+mZcyVEU9diMXoQ30pYRSfY39N57+PGSxPGikMqdks h2RwbNPxgwHmGiOOAYIxMCDKE+e8RB5jcK6kTcvWYR5R6um+VdukeF9oPor7iIoXH1T7YKA83k4 R0vN/VJZNxVNDEx+9qSQ== X-Received: by 2002:a17:902:ef45:b0:2b0:4eeb:f807 with SMTP id d9443c01a7336-2b0cdc3e969mr68503115ad.13.1774724297746; Sat, 28 Mar 2026 11:58:17 -0700 (PDT) Received: from kfuzz ([202.120.234.33]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2427b1ef0sm37793225ad.74.2026.03.28.11.58.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 28 Mar 2026 11:58:17 -0700 (PDT) From: Kangzheng Gu To: gregkh@linuxfoundation.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kees@kernel.org, p@1g4.org, xiaoguai0992@gmail.com Cc: netdev@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] net-shapers: free rollback entries using kfree_rcu Date: Sat, 28 Mar 2026 18:58:04 +0000 Message-ID: <20260328185804.41325-1-xiaoguai0992@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" net_shaper_rollback() removes NET_SHAPER_NOT_VALID entries and frees them using kfree(), which can race with net_shaper_nl_get_dumpit() and lead to a use-after-free in net_shaper_fill_one(). Use kfree_rcu() instead of kfree() to free rollback entries, since net_shaper_nl_get_dumpit() protects shaper access with rcu_read_lock(). Cc: stable@vger.kernel.org Fixes: 93954b40f6a4 ("net-shapers: implement NL set and delete operations") Signed-off-by: Kangzheng Gu --- net/shaper/shaper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c index 94bc9c7382ea..8922f7f64768 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c @@ -434,7 +434,7 @@ static void net_shaper_rollback(struct net_shaper_bindi= ng *binding) xa_for_each_marked(&hierarchy->shapers, index, cur, NET_SHAPER_NOT_VALID) { __xa_erase(&hierarchy->shapers, index); - kfree(cur); + kfree_rcu(cur, rcu); } xa_unlock(&hierarchy->shapers); } --=20 2.50.1