diff options
| author | Carolina Jubran <cjubran@nvidia.com> | 2026-09-02 22:33:41 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-05 13:19:22 -0700 |
| commit | af3aef0245abbab5e9f6302e7a7d6407187afb71 (patch) | |
| tree | 82a05e3122dc84e4901d8c286de2aff0e810a593 /scripts/basic/split-include.c | |
| parent | e7ee89740800a1cf253713e9249c3ee9203ebe91 (diff) | |
| download | linux-af3aef0245abbab5e9f6302e7a7d6407187afb71.tar.gz linux-af3aef0245abbab5e9f6302e7a7d6407187afb71.zip | |
net/mlx5e: Fix use-after-free race in sample_restore_put()
Concurrent teardown of TC sample rules sharing the same restore
context may re-read restore->count after dropping restore_lock.
At that point another thread may already have completed cleanup and
freed the restore object.
Use the result of the refcount decrement while holding restore_lock to
determine whether cleanup is needed.
Fixes: 36a3196256bf ("net/mlx5e: TC, Add sampler restore handle API")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Shahar Shitrit <shshitrit@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260902193341.3668809-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions