From nobody Mon Jun 8 14:36:13 2026 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1574C3D3CF9 for ; Thu, 28 May 2026 16:08:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779984531; cv=none; b=sOnN8//N2CXXIgR6ILv2hbgv3Ex9fILEiJ8S7dquYpb2UyQQjh/dgLbd+MrOcIQrw3QI20DwbYPD/Pq2AZQeHa/uPHL7860WPxQDb1eBwpQvgcYzxEFsOU2nO4zXjN4KRI2HVTrIF+N/icuEyrvJtk1ZOE1KLxQtQxicirjX65U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779984531; c=relaxed/simple; bh=ArFEvS4iIE1COp0yWeMQ913sIk1iOU6y5FWc4jgQSiY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dkeAvpKyIMyssZElvL+VrqyCN9MelsI6g4gOpxOFq9jj8jhZDhWh6NxZU+waJtSjlcOpsHAmtQFzQ7H6i4/jf62aaRFB6gvcOtpO/TfR5WflphkdxxKChr9cDoaLVIYAXL8VXQkEX3/xjXPY4YGcs9Z+5cVG38wieG6gGCNeQgE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Ngt0zBZV; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ngt0zBZV" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-49039a8851fso74439945e9.2 for ; Thu, 28 May 2026 09:08:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779984527; x=1780589327; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=vx53jYFxFDkAaLXRXoaHF+KJ6Qv4XL53bOT7CIR8w+k=; b=Ngt0zBZVdrv9VisRHKAKEEYXzwa2DNKEprnFQ/4lSjytKPMaWTWAdd/81jdBsGFHIN fC9zY4DJLTPs4Ndv97boyWNpGKH+JpvHCRE3XTgsFFjVtiLO0HPUvLMA76TWnV08lxc3 3w2XbN1ww4l0xZXXr/8KHN4MPdzbDyync+wc9RPixnWJ1AX5UpZXAM1BRukQYfCKLjGR pWkgnR5ksnby8EwqFTNiWoNWDqQmKj9inGdjIViJ7MaRL3aKK9DJxXNyMjSgGVlb+0eX tGsChi+BOajyjx4HemewYkfEupCGxfJ5GM01hZIWFRcX1otZTyA+EBuuadGQvwSPN0yb RWOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779984527; x=1780589327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=vx53jYFxFDkAaLXRXoaHF+KJ6Qv4XL53bOT7CIR8w+k=; b=sIkLmUVTs0ZLsF4dUTb9/+vN9EhBhMouEmff/kbbe3qmUUM+CLNIOstBK3+bbDa97d K/euHQ6clbwDnSiyBYm9C1d1t1rRZsDoBD8iskyERrNx5SbyKGUdiueUjk7OkxicRzp3 cY+taQMtaKLVpHE4c4BQ76CqjXfVuEGOjAMwYgqwDFBck/vhttcD+iiQtx1i9BqJoZrQ hCPgeDwY6RYl9HQ0OImRG7Mykj+kp4K5uolLa3pEQ4aLTwmY/+9DPW/akYF1jONFCQIq uim/5PnvwhGH3Wp61WMCXzXGLOlCN7ldYfY8/Vrc/zLAjw59IGdyM6u1jful73b7i09P FqJw== X-Forwarded-Encrypted: i=1; AFNElJ+I9VIUXrxSvyDsoD0F1GlWJ+ToCjy5Uym/03mypjphuwdH1FZV9jDoFJCsUSfownsqyEOAXdbAb9OmZHU=@vger.kernel.org X-Gm-Message-State: AOJu0YxFZqPh6yXkTNpnmmICuQF49ssjIFL8dsfRvFTtoLMjmJXX0dlr S/67BO6aYjIYgihaDpyoYtk3XAvuCWLtjP9LIt8/EydRfOKKZrVxLOuSxXNo X-Gm-Gg: Acq92OHjxVFK5pxNoJPhSOY8qYFt/sox/38eHDJKX6C+aWWJQ4vtt0/9aUSu8L3GkbQ 9P4Yc0qtbKcJ2PZA5wOmJec+tOi4tIbCGOshsW2glA0SPf3P/u97jIivxiyQvRKHzIDIZM3/5Zw sDdxnIISGTujK0ZzcyhvcRChyHe+V2gRhJ9HIl2kfnhlJqOvEqa+wgrtm3RcDiuiM+8zroImjN6 SObCMTsdyoH7Ivk0zSEPotN6nUH44AQ7f+mVZXIA5FjPOe2XirqtsgMPC5qJhq7aktHPBoypMKY EDVRpSutpZwcEYHSlOxuILdHIdGQoqDuSDoVtN04Uf/Xh1v1OHmXnyziHTfrikEz7FMV42oU0tS f/625KiF1EUKGe8KRfA13xx6Sg3VrC4tiJ5bRlgxSHq3+op6R17SkmB+blZi9TPTlwybqp1xMKQ stUJTwmkVF2tXp/61d X-Received: by 2002:a05:600c:a012:b0:490:5191:6e26 with SMTP id 5b1f17b1804b1-490519170bamr421905655e9.18.1779984527176; Thu, 28 May 2026 09:08:47 -0700 (PDT) Received: from debian.. ([2001:41d0:303:db6b::]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45ee4491d77sm6950094f8f.4.2026.05.28.09.08.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 May 2026 09:08:46 -0700 (PDT) From: Tristan Madani X-Google-Original-From: Tristan Madani To: Jakub Kicinski , Paolo Abeni Cc: "David S. Miller" , Eric Dumazet , Simon Horman , netdev@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] net: shaper: use kfree_rcu() in net_shaper_flush() Date: Thu, 28 May 2026 16:08:45 +0000 Message-ID: <20260528160845.2636043-1-tristan@talencesecurity.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" net_shaper_flush() frees shaper objects with plain kfree() after xa_erase(), but net_shaper_nl_get_doit() and net_shaper_nl_get_dumpit() read shaper objects under rcu_read_lock() via xa_load(). This creates a use-after-free window where an RCU reader may still hold a pointer to a shaper object that has been freed. The race is: CPU 0 (reader) CPU 1 (flush/unregister) rcu_read_lock() shaper =3D xa_load(...) xa_lock() // shaper points to valid obj __xa_erase(...) kfree(shaper) <- frees immediately net_shaper_fill_one(shaper) xa_unlock() // use-after-free rcu_read_unlock() Other code paths in the same file already use kfree_rcu() correctly (net_shaper_pre_insert error path, net_shaper_notify_down, net_shaper_cap_pair_update, and net_shaper_rollback as of commit b8d7519352ba). The struct net_shaper already contains an rcu_head field. Fix by replacing kfree() with kfree_rcu() in net_shaper_flush() to defer freeing until after the RCU grace period. Found by source code audit. Fixes: ff7d4deb1f3e ("net-shapers: implement shaper cleanup on queue deleti= on") Cc: Paolo Abeni Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- net/shaper/shaper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/shaper/shaper.c b/net/shaper/shaper.c index dea9270f3e57d..92a6939787240 100644 --- a/net/shaper/shaper.c +++ b/net/shaper/shaper.c @@ -1475,7 +1475,7 @@ static void net_shaper_flush(struct net_shaper_bindin= g *binding) xa_lock(&hierarchy->shapers); xa_for_each(&hierarchy->shapers, index, cur) { __xa_erase(&hierarchy->shapers, index); - kfree(cur); + kfree_rcu(cur, rcu); } xa_unlock(&hierarchy->shapers); =20 --=20 2.47.3