Re: [PATCH] net/sched: act_tunnel_key: Defer dst_release to RCU callback

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Sat, 11 Jul 2026 11:05:37 -0400 you wrote:

Fix a race-condition use-after-free in tunnel_key_release_params().

The function releases the metadata_dst of the old params synchronously
via dst_release() while deferring the params struct free with
kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
still hold the old params pointer (under rcu_read_lock_bh) and proceed
to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's
dst_release has already pushed the dst's rcuref to RCUREF_DEAD.

[...]

Here is the summary with links:
  - net/sched: act_tunnel_key: Defer dst_release to RCU callback
    https://git.kernel.org/netdev/net/c/f1f5c8a3955f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html