Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:
On Sat, 28 Feb 2026 23:53:07 +0900 you wrote:
When shrinking the number of real tx queues,
netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush
qdiscs for queues which will no longer be used.
qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with
qdisc_lock(). However, for lockless qdiscs, the dequeue path is
serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so
qdisc_reset() can run concurrently with __qdisc_run() and free skbs
while they are still being dequeued, leading to UAF.
[...]
Here is the summary with links:
- net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
https://git.kernel.org/netdev/net/c/7f083faf59d1
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html