]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net/sched: fix use-after-free in taprio_dev_notifier
authorHyunwoo Kim <imv4bel@gmail.com>
Sat, 14 Jun 2025 00:54:57 +0000 (20:54 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:11:21 +0000 (11:11 +0100)
commit8a008c89e5e5c5332e4c0a33d707db9ddd529f8a
tree20a64da025c5f8a2c4c6cdeb239f5e9ddf76e1c9
parent55c3dbd8389636161090a2b2b6d2d709b9602e9c
net/sched: fix use-after-free in taprio_dev_notifier

commit b160766e26d4e2e2d6fe2294e0b02f92baefcec5 upstream.

Since taprio’s taprio_dev_notifier() isn’t protected by an
RCU read-side critical section, a race with advance_sched()
can lead to a use-after-free.

Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.

Fixes: fed87cc6718a ("net/sched: taprio: automatically calculate queueMaxSDU based on TC gate durations")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/aEzIYYxt0is9upYG@v4bel-B760M-AORUS-ELITE-AX
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sched/sch_taprio.c