Re: [PATCH net v2] cls_flower: fix use after free in flower S/W path

2018-06-21 Thread David Miller
From: Paolo Abeni Date: Thu, 21 Jun 2018 20:02:16 +0200 > If flower filter is created without the skip_sw flag, fl_mask_put() > can race with fl_classify() and we can destroy the mask rhashtable > while a lookup operation is accessing it. ... > Fix the above waiting for a RCU grace period before

Re: [PATCH net v2] cls_flower: fix use after free in flower S/W path

2018-06-21 Thread Jiri Pirko
Thu, Jun 21, 2018 at 08:02:16PM CEST, pab...@redhat.com wrote: >If flower filter is created without the skip_sw flag, fl_mask_put() >can race with fl_classify() and we can destroy the mask rhashtable >while a lookup operation is accessing it. > > BUG: unable to handle kernel paging request at 0

[PATCH net v2] cls_flower: fix use after free in flower S/W path

2018-06-21 Thread Paolo Abeni
If flower filter is created without the skip_sw flag, fl_mask_put() can race with fl_classify() and we can destroy the mask rhashtable while a lookup operation is accessing it. BUG: unable to handle kernel paging request at 000911d1 PGD 0 P4D 0 SMP PTI CPU: 3 PID: 5582 Comm: vhost-5541