Xiang Mei 5e28d5a3f7 net/sched: sch_qfq: Fix race condition on qfq_aggregate ...

A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.

This patch addresses the issue by:

1. Moved qfq_destroy_class into the critical section.

2. Added sch_tree_lock protection to qfq_dump_class and
qfq_dump_class_stats.

Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2025-07-13 00:09:33 +01:00

..

act_api.c

tc: Return an error if filters try to attach too many actions

2025-04-15 17:13:11 -07:00

act_bpf.c

net: Rename mono_delivery_time to tstamp_type for scalabilty

2024-05-23 14:14:23 -07:00

act_connmark.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_csum.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_ct.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

act_ctinfo.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

act_gact.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_gate.c

net/sched: Switch to use hrtimer_setup()

2025-02-18 10:35:44 +01:00

act_ife.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_meta_mark.c

…

act_meta_skbprio.c

…

act_meta_skbtcindex.c

…

act_mirred.c

net/sched: act_mirred: Move the recursion counter struct netdev_xmit

2025-05-15 15:23:31 +02:00

act_mpls.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

act_nat.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_pedit.c

net: sched: Annotate struct tc_pedit with __counted_by

2024-02-19 10:58:24 +00:00

act_police.c

net: convert to nla_get_*_default()

2024-11-11 10:32:06 -08:00

act_sample.c

net: sched: act_sample: add action cookie to sample

2024-07-05 17:45:47 -07:00

act_simple.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_skbedit.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

act_skbmod.c

net/sched: act_skbmod: convert comma to semicolon

2024-07-11 17:12:15 -07:00

act_tunnel_key.c

net: fix geneve_opt length integer overflow

2025-04-03 15:47:35 -07:00

act_vlan.c

tc: adjust network header after 2nd vlan push

2024-08-27 11:37:42 +02:00

bpf_qdisc.c

bpf: net_sched: Make some Qdisc_ops ops mandatory

2025-05-02 15:35:37 -07:00

cls_api.c

tc: Ensure we have enough buffer space when sending filter netlink notifications

2025-04-08 13:57:49 +02:00

cls_basic.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

cls_bpf.c

net: sched: refine software bypass handling in tc_run

2025-01-20 09:21:27 +00:00

cls_cgroup.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

cls_flow.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

cls_flower.c

net: fix geneve_opt length integer overflow

2025-04-03 15:47:35 -07:00

cls_fw.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

cls_matchall.c

net: sched: refine software bypass handling in tc_run

2025-01-20 09:21:27 +00:00

cls_route.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

cls_u32.c

net: sched: refine software bypass handling in tc_run

2025-01-20 09:21:27 +00:00

em_canid.c

net: fill in MODULE_DESCRIPTION()s for net/sched

2024-02-09 14:12:02 -08:00

em_cmp.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

em_ipset.c

…

em_ipt.c

…

em_meta.c

net: dismiss sk_forward_alloc_get()

2025-02-19 19:05:28 -08:00

em_nbyte.c

net: fill in MODULE_DESCRIPTION()s for net/sched

2024-02-09 14:12:02 -08:00

em_text.c

net: fill in MODULE_DESCRIPTION()s for net/sched

2024-02-09 14:12:02 -08:00

em_u32.c

net: fill in MODULE_DESCRIPTION()s for net/sched

2024-02-09 14:12:02 -08:00

ematch.c

…

Kconfig

sctp: use skb_crc32c() instead of __skb_checksum()

2025-05-21 15:40:16 -07:00

Makefile

bpf: net_sched: Support implementation of Qdisc_ops in bpf

2025-04-17 10:54:33 -07:00

sch_api.c

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-07-10 11:08:35 +02:00

sch_blackhole.c

…

sch_cake.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-01-09 16:11:47 -08:00

sch_cbs.c

net/sched: cbs: Fix integer overflow in cbs_set_port_rate()

2024-10-15 18:25:47 -07:00

sch_choke.c

net: sched: fix ordering of qlen adjustment

2024-12-04 12:54:22 +00:00

sch_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-09 12:34:38 +01:00

sch_drr.c

net_sched: drr: Fix double list add in class with netem as child qdisc

2025-04-28 15:55:06 -07:00

sch_etf.c

net_sched: sch_tfs: implement lockless etf_dump()

2024-04-19 11:34:07 +01:00

sch_ets.c

net_sched: ets: fix a race in ets_qdisc_change()

2025-06-12 08:05:50 -07:00

sch_fifo.c

pfifo_tail_enqueue: Drop new packet when sch->limit == 0

2025-02-05 18:13:58 -08:00

sch_fq_codel.c

net_sched: Flush gso_skb list too during ->change()

2025-05-09 12:34:38 +01:00

sch_fq_pie.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

sch_fq.c

net_sched: Flush gso_skb list too during ->change()

2025-05-09 12:34:38 +01:00

sch_frag.c

net/sched: Use nested-BH locking for sch_frag_data_storage

2025-05-15 15:23:31 +02:00

sch_generic.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

sch_gred.c

sched: address a potential NULL pointer dereference in the GRED scheduler.

2025-03-06 16:35:14 -08:00

sch_hfsc.c

net/sched: sch_qfq: Fix null-deref in agg_dequeue

2025-07-10 11:08:35 +02:00

sch_hhf.c

net_sched: Flush gso_skb list too during ->change()

2025-05-09 12:34:38 +01:00

sch_htb.c

sch_htb: make htb_deactivate() idempotent

2025-05-05 13:51:32 -07:00

sch_ingress.c

bpf: Fix too early release of tcx_entry

2024-07-08 14:07:31 -07:00

sch_mq.c

…

sch_mqprio_lib.c

…

sch_mqprio_lib.h

…

sch_mqprio.c

netlink: introduce type-checking attribute iteration

2024-03-29 15:06:02 -07:00

sch_multiq.c

net: sched: sch_multiq: fix possible OOB write in multiq_tune()

2024-06-05 10:50:19 +01:00

sch_netem.c

netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()

2025-02-05 18:14:46 -08:00

sch_pie.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

sch_plug.c

net/sched: Add module aliases for cls_,sch_,act_ modules

2024-02-02 10:57:55 -08:00

sch_prio.c

net_sched: prio: fix a race in prio_tune()

2025-06-12 08:05:49 -07:00

sch_qfq.c

net/sched: sch_qfq: Fix race condition on qfq_aggregate

2025-07-13 00:09:33 +01:00

sch_red.c

Merge tag 'net-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-06-12 09:50:36 -07:00

sch_sfb.c

net/sched: Add drop reasons for AQM-based qdiscs

2024-12-17 13:27:29 +01:00

sch_sfq.c

Merge tag 'net-6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-06-12 09:50:36 -07:00

sch_skbprio.c

net_sched: skbprio: Remove overly strict queue assertions

2025-04-02 16:03:32 -07:00

sch_taprio.c

net/sched: fix use-after-free in taprio_dev_notifier

2025-06-17 16:14:04 -07:00

sch_tbf.c

net_sched: tbf: fix a race in tbf_change()

2025-06-12 08:05:50 -07:00

sch_teql.c

net: annotate writes on dev->mtu from ndo_change_mtu()

2024-05-07 16:19:14 -07:00