From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ua1-f49.google.com (mail-ua1-f49.google.com [209.85.222.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 671E539B4A3 for ; Wed, 27 May 2026 17:38:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779903534; cv=none; b=rInsrD45qssFvD5iyn+2UqYbtMHxKye8AWrgroSwbIbtqjmjk45uVal160wFlTXeRP2Vb767C9vWP1m/r2NvtA31WsC88Z+iNu+sqzOJHqd0NY35OT9bkvLZTYl7uDOMybU+QMv+02COn3DZwMhd+N3S13kMaHG5gqewgrgbaUI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779903534; c=relaxed/simple; bh=9sBovYNOPoDOq7s4sZP2IsRza7iSK++mMdMeA8dhfYw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ejcY3x66rUAh/0poURkgNIQHYS2ZHn1a0WNaWYrg8BBVH7qyd6dWsdiY5TXpNEi+EZZW80ZLzrRGdBkoUmi0/A5GgFcmB1L9utI8grc+PqnzUQaMzdktVpdVlaLJrGm4LQqWO8fqaP/zB2McqhoDPNV4RP/zmeiUdYF32NlXUpc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com; spf=none smtp.mailfrom=mojatatu.com; dkim=pass (2048-bit key) header.d=mojatatu-com.20251104.gappssmtp.com header.i=@mojatatu-com.20251104.gappssmtp.com header.b=brcUSuok; arc=none smtp.client-ip=209.85.222.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=mojatatu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=mojatatu-com.20251104.gappssmtp.com header.i=@mojatatu-com.20251104.gappssmtp.com header.b="brcUSuok" Received: by mail-ua1-f49.google.com with SMTP id a1e0cc1a2514c-9638d15f871so98483241.2 for ; Wed, 27 May 2026 10:38:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mojatatu-com.20251104.gappssmtp.com; s=20251104; t=1779903532; x=1780508332; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=C+ZMotmKA69XktY7YZVd+0HlOa08ng6yma1cuEVxEak=; b=brcUSuokjsCkY3sOIWXocVz5TaCZ8hZAwxgDaBsoGm3CQBfCWbGv/3p9r+EL/ooCMK Oc19/eU38MECRe6wDgZAbsQA2VD2EoljvzZ2086kq0gx+fBa4QsaaiZv0GEG45AQjpju 7zX6N+B1d6X3/ikE6D1OaPKkzZvd94HZAmOyQnTS2Wl/5rjFEijq8YLRFBge4Ue51ejZ UkcbZuapXiQlziOFpCfV/oybGQ8SGf8BEGE1KGtXex1orIcRfb7aMdY5SxJIEsWMqW8u E/sQcwFW+l1b9MmXJUSYJkrTt4UfQMzOSKhhE9+kR5aW80u3nRW+EMVV4qOB46X1xMa8 X0Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779903532; x=1780508332; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=C+ZMotmKA69XktY7YZVd+0HlOa08ng6yma1cuEVxEak=; b=J2S4j7l3+h2GrmnF3X7bnoav17ULRUdyuHamg6ggEow9bMYW0zexF6eFHwOSrirXpT z8goMzwYMWxCtSm83H1IRWLMBZbeVufS7CqBUoIFxTYTs+n7hNs8nwT+ekEV6wyZHsEQ U1sP4bQP4bQ9WhECfKFmlQWdcx82T6oNqiw5VfVj8xum5ssIwhgc2b14oFZ60K5uB45I PuhN2N86OrUcEBP/2xFXk/xvJx5vcpVHrqrmCGLFRvjvCq2oWjx00Id36EAjz555INn3 LeVNFsL3tO1VRpR/1Ce9lhQd3RMhSRggijgiyoilOJpDC34u1vGVSu+2hFZj5wXAsJFb 0Zng== X-Forwarded-Encrypted: i=1; AFNElJ+Vodo9w6k5HzggK9IVr3ANVOGFKXnkNy4zHWgCmrgOgR/TWoF1+t7qRHB+vYTlMQeX88HgkwKRGwhIaUw=@vger.kernel.org X-Gm-Message-State: AOJu0Yxpw56zW5j9q4LHRVw3kNl1g9/xwZx7Q1xEiVJhCw8aeKLrdxji IVpP+fWvQ9JAgCU7MOMau2GVZX5eZjym+2373eHclnr1gdxol6RnNy6fZITMgFrVgw== X-Gm-Gg: Acq92OEtanWT7icNnno/a0ty1EKCtf0fYPYBTXCTHreiQ+fWAKxXAI/iGWjuJFbnktf X9QJMc9nzaHKvmYT3qjZDKwnHEsuQiRW4tJ2Z/NwpL/7BZBiS/UoJbmSo5jtHGhXuXNstzZEnA4 dDs3lQyuBMAv/ZfStFhYaG3J0ZWYArB4dPsG9HAdZEZQZA7ehFIydRll30wF9MCDJP3DAMcOB+Q mYtx+nXEVvNNNRpQgdosdTl8nO0NA9hcvd0u5uGqKL0NNUe7Em4LWMEryigSIqD8xfJ0nUFO/yr EWEDLqBbL700LIvTrxNtIqXnqsUnsKGwUrXUWrJg2ItyLTqwwUHabn2MhBYgYSu5iN53tiwKtjr lFWUvB0C9XWRcBFCbfbOyQOjMA/v0WuMP29AOM1C7VPWvMaxPLZN1LnaVPIA1814j4EwlPLZDCW sDi3a0+S5vGBGpItjza7lOqw7Ja7SRUYdWqkV0iOa89Q== X-Received: by 2002:a05:6102:441d:b0:5f7:240f:bbee with SMTP id ada2fe7eead31-67c7490bbe1mr10683274137.1.1779903532192; Wed, 27 May 2026 10:38:52 -0700 (PDT) Received: from [192.168.50.25] ([179.218.14.134]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-67ff5f0820csm17925711137.11.2026.05.27.10.38.48 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 27 May 2026 10:38:51 -0700 (PDT) Message-ID: Date: Wed, 27 May 2026 14:38:46 -0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] net/sched: act_api: use mutex in tcf_idr_check_alloc To: Kyle Zeng , Jamal Hadi Salim , Jiri Pirko Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Vlad Buslov , netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260526220847.28365-1-kylebot@openai.com> Content-Language: en-US From: Pedro Tammela In-Reply-To: <20260526220847.28365-1-kylebot@openai.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 26/05/2026 19:08, Kyle Zeng wrote: > Currently, the NEWTFILTER path uses RCU to guard action idr accesses while > the DELTFILTER path uses mutex to guard action accesses. This > inconsistency leads to a race condition scenario, which can lead to > erroneous operations on refcount, eventually leading to use-after-free > situation. > In this patch, we revert the introduction of RCU back to mutex in the > NEWFILTER path, which is consistent with the DELFILTER path, avoiding > the race condition. > > Fixes: 4b55e86736d5 ("net/sched: act_api: rely on rcu in tcf_idr_check_alloc") > Signed-off-by: Kyle Zeng Reviewed-by: Pedro Tammela > --- > net/sched/act_api.c | 12 +++++------- > 1 file changed, 5 insertions(+), 7 deletions(-) > > diff --git a/net/sched/act_api.c b/net/sched/act_api.c > index 332fd9695e54..63841c3e4310 100644 > --- a/net/sched/act_api.c > +++ b/net/sched/act_api.c > @@ -874,36 +874,34 @@ int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index, > u32 max; > > if (*index) { > - rcu_read_lock(); > + mutex_lock(&idrinfo->lock); > p = idr_find(&idrinfo->action_idr, *index); > > if (IS_ERR(p)) { > /* This means that another process allocated > * index but did not assign the pointer yet. > */ > - rcu_read_unlock(); > + mutex_unlock(&idrinfo->lock); > return -EAGAIN; > } > > if (!p) { > /* Empty slot, try to allocate it */ > max = *index; > - rcu_read_unlock(); > + mutex_unlock(&idrinfo->lock); > goto new; > } > > if (!refcount_inc_not_zero(&p->tcfa_refcnt)) { > /* Action was deleted in parallel */ > - rcu_read_unlock(); > + mutex_unlock(&idrinfo->lock); > return -EAGAIN; > } > > if (bind) > atomic_inc(&p->tcfa_bindcnt); > *a = p; > - > - rcu_read_unlock(); > - > + mutex_unlock(&idrinfo->lock); > return 1; > } else { > /* Find a slot */