Re: [PATCH net 1/2] net-shapers: clear hierarchy pointer and defer flush frees with RCU

[Jakub Kicinski]

On Wed, 11 Mar 2026 14:04:54 +0000 Paul Moses wrote:
> The reported UAF was in the GET doit reader path.
> 
> GET doit enters rcu_read_lock(), then net_shaper_lookup() performs
> READ_ONCE(netdev->net_shaper_hierarchy) and walks the xarray locklessly.
> 
> GET dump reads the hierarchy pointer first, then enters rcu_read_lock()
> and uses xa_find() to walk the xarray.
> 
> Both paths rely on RCU to keep the hierarchy and its shapers valid during
> the lockless walk.

RCU was never intended to protect the whole hierarchy in shapers.
Only individual shapers inside the xarray.
The struct net_shaper_hierarchy is allocated lazily but it is never
freed during lifetime of the device, only once the device is dead.

The bug is that we are accessing a dead device.

(reminder: please quote what you're replying to correctly during ML
discussions)