From: Jakub Kicinski Date: Tue, 1 Aug 2023 03:10:39 +0000 (-0700) Subject: Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' X-Git-Tag: v6.6.7~2249^2~20 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=c5ccff70501d92db445a135fa49cf9bc6b98c444;p=platform%2Fkernel%2Flinux-starfive.git Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' valis says: ==================== net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route Three classifiers (cls_fw, cls_u32 and cls_route) always copy tcf_result struct into the new instance of the filter on update. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. This patch set fixes this issue in all affected classifiers by no longer copying the tcf_result struct from the old filter. ==================== Link: https://lore.kernel.org/r/20230729123202.72406-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski --- c5ccff70501d92db445a135fa49cf9bc6b98c444