On Fri, Sep 15, 2023 at 1:08 PM Ma Ke <[email protected]> wrote:
>
> If asked to drop a packet via TC_ACT_SHOT it is unsafe to
> assume that res.class contains a valid pointer.
>
> Signed-off-by: Ma Ke <[email protected]>
> ---
> net/sched/sch_qfq.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
> index 546c10adcacd..20d52dc484b6 100644
> --- a/net/sched/sch_qfq.c
> +++ b/net/sched/sch_qfq.c
> @@ -695,6 +695,8 @@ static struct qfq_class *qfq_classify(struct sk_buff *skb, struct Qdisc *sch,
> *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
> fl = rcu_dereference_bh(q->filter_list);
> result = tcf_classify(skb, NULL, fl, &res, false);
> + if (result == TC_ACT_SHOT)
> + return NULL;
> if (result >= 0) {
> #ifdef CONFIG_NET_CLS_ACT
> switch (result) {
> --
> 2.37.2
>
Same comment, it seems already handled at line 706