github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-08 03:26:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
156fa7417f
linux/net/sched
History
Xuanqiang Luo 6e05e46fa8 net/sched: act_api: release tail references on DELACTION failure 
A batched RTM_DELACTION request takes a temporary reference on each
action before attempting any deletion. tcf_action_delete() clears
each processed slot and drops its temporary reference before attempting
the deletion. If deletion fails, tca_action_gd() calls
tcf_action_put_many() to release the remaining references, but its
tcf_act_for_each_action() iterator stops at the first NULL slot.

When a batch stops at an action bound to a filter, this leaks a
reference on each subsequent action. A later delete of an unbound
action can then return success without removing it from the IDR.

Walk the full array in tcf_action_put_many() and skip NULL slots to
release the references held on the unprocessed actions.

Fixes: a0e947c9cc ("net/sched: act_api: avoid non-contiguous action array")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260910093413.34509-2-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-15 17:03:09 -07:00
..
act_api.c net/sched: act_api: release tail references on DELACTION failure 2026-09-15 17:03:09 -07:00
act_bpf.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_connmark.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_csum.c net: Use helpers to get/set UDP len tree-wide 2026-07-22 13:47:02 +02:00
act_ct.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_ctinfo.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_gact.c net/sched: act_gact, act_police: range check the fallback control action 2026-08-10 16:00:19 -07:00
act_gate.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
act_ife.c net/sched: act_ife: Only operate on Ethernet frames 2026-08-24 11:59:59 -07:00
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c net/sched: act_mirred: Fix return code in early mirred redirect error paths 2026-05-28 12:26:36 +02:00
act_mpls.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_nat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
act_pedit.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_police.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_sample.c net/sched: add get_fill_size callbacks for actions missing them 2026-08-20 12:16:43 -07:00
act_simple.c net/sched: Remove redundant memset(0) call in reset_policy() 2025-08-12 17:13:29 -07:00
act_skbedit.c net/sched: add qstats_cpu_drop_inc() helper 2026-05-04 18:59:07 -07:00
act_skbmod.c net/sched: act_skbmod: fix length calculations and avoid invalid header warnings 2026-08-25 11:04:12 +02:00
act_tunnel_key.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
act_vlan.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bpf_qdisc.c bpf: net_sched: Use the correct destructor kfunc type 2026-01-12 18:53:57 -08:00
cls_api.c net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 2026-09-10 12:06:23 +02:00
cls_basic.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_bpf.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_cgroup.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flow.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_flower.c net/sched: cls_flower: validate mask pointer after nla_next() 2026-08-31 17:02:56 -07:00
cls_fw.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_matchall.c net/sched: account classifier filter allocations to memcg 2026-08-22 13:02:32 -07:00
cls_route.c net/sched: cls_route: Fix in-place replace 2026-09-10 11:27:52 +02:00
cls_u32.c net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted 2026-08-31 16:07:33 -07:00
em_canid.c net/sched: em_canid: fix uninit-value in em_canid_match 2025-11-26 16:28:10 +01:00
em_cmp.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_ipset.c
em_ipt.c
em_meta.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_nbyte.c net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr() 2025-11-24 18:53:14 -08:00
em_text.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
em_u32.c
ematch.c
Kconfig sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
Makefile sched: Add enqueue/dequeue of dualpi2 qdisc 2025-07-23 17:52:07 -07:00
sch_api.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_blackhole.c
sch_cake.c net/sched: sch_cake: fix autorate reconfiguration throttling 2026-08-22 13:51:40 -07:00
sch_cbs.c net: sched: avoid printing uninitialized link speed 2026-06-11 15:44:55 +02:00
sch_choke.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_codel.c net/sched: sch_codel: clamp default mtu to avoid disabling CoDel 2026-08-25 13:09:32 +02:00
sch_drr.c net/sched: drr: clamp quantum in change class 2026-09-05 13:48:08 -07:00
sch_dualpi2.c net/sched: dualpi2: clamp psched_mtu at all call sites 2026-09-05 13:48:02 -07:00
sch_etf.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_ets.c net/sched: ets: clamp quantum in parse and fallback paths 2026-09-05 13:48:08 -07:00
sch_fifo.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_fq_codel.c net/sched: fq_codel: clamp default quantum and mtu 2026-08-25 13:09:32 +02:00
sch_fq_pie.c net/sched: fq_pie: clamp quantum in change path 2026-09-05 13:47:29 -07:00
sch_fq.c net/sched: fq: clamp quantum and initial_quantum in change path 2026-09-05 13:47:29 -07:00
sch_frag.c net: convert remaining ipv6_stub users to direct function calls 2026-03-29 11:21:23 -07:00
sch_generic.c net/sched: defer qdisc freeing after failed creation 2026-09-05 12:40:05 -07:00
sch_gred.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_hfsc.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_hhf.c net/sched: hhf: cap hh_flows_limit at change time 2026-09-15 13:30:53 +02:00
sch_htb.c net/sched: sch_htb: limit htb_classify inner-class filter hops 2026-08-27 12:47:58 -07:00
sch_ingress.c clsact: Fix use-after-free in init/destroy rollback asymmetry 2026-03-17 12:09:16 +01:00
sch_mq.c net/sched: mq: no longer acquire qdisc spinlocks in dump operations 2026-05-11 18:28:08 -07:00
sch_mqprio_lib.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_mqprio_lib.h
sch_mqprio.c net: prevent torn reads in netdev_tc_txq 2026-08-17 10:27:48 -07:00
sch_multiq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_netem.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-05-28 14:02:21 -07:00
sch_pie.c net/sched: pie: clamp psched_mtu in pie_drop_early 2026-09-05 13:48:08 -07:00
sch_plug.c net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue 2026-08-20 13:28:45 -07:00
sch_prio.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_qfq.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_red.c net/sched: annotate data-races around sch->qstats.backlog 2026-05-11 18:28:07 -07:00
sch_sfb.c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 2026-07-20 18:16:43 -07:00
sch_sfq.c net/sched: sfq: clamp quantum in change path 2026-09-05 13:47:30 -07:00
sch_skbprio.c net/sched: add qdisc_qlen_inc() and qdisc_qlen_dec() 2026-05-11 18:28:07 -07:00
sch_taprio.c net: add READ_ONCE()/WRITE_ONCE() annotations for dev->prio_tc_map 2026-08-17 10:27:48 -07:00
sch_tbf.c net/sched: tbf: add extack to offload params 2026-05-22 17:23:37 -07:00
sch_teql.c net/sched: sch_teql: restore skb->dev on the slave failure path 2026-08-25 15:24:35 +02:00