diff options
| author | Xiang Mei <xmei5@asu.edu> | 2025-07-10 03:09:42 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-24 08:58:34 +0200 |
| commit | c000a3a330d97f6c073ace5aa5faf94b9adb4b79 (patch) | |
| tree | e2506ef3007f9c6999d79fb06d3690306ab39490 /tools/perf/scripts/python/stackcollapse.py | |
| parent | d3c48fc43319183365a49057078ab88123acc22d (diff) | |
| download | kernel-c000a3a330d97f6c073ace5aa5faf94b9adb4b79.tar.gz | |
net/sched: sch_qfq: Fix race condition on qfq_aggregate
[ Upstream commit 5e28d5a3f774f118896aec17a3a20a9c5c9dfc64 ]
A race condition can occur when 'agg' is modified in qfq_change_agg
(called during qfq_enqueue) while other threads access it
concurrently. For example, qfq_dump_class may trigger a NULL
dereference, and qfq_delete_class may cause a use-after-free.
This patch addresses the issue by:
1. Moved qfq_destroy_class into the critical section.
2. Added sch_tree_lock protection to qfq_dump_class and
qfq_dump_class_stats.
Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions