Patch "net/sched: flower: Fix wrong handle assignment during filter change" has been added to the 6.3-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/sched: flower: Fix wrong handle assignment during filter change

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-flower-fix-wrong-handle-assignment-during-.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1eb6ef143b65e5adba92965acd9c71756589aa0e
Author: Ivan Vecera <ivecera@xxxxxxxxxx>
Date:   Tue Apr 25 16:06:04 2023 +0200

    net/sched: flower: Fix wrong handle assignment during filter change
    
    [ Upstream commit 32eff6bacec2cb574677c15378169a9fa30043ef ]
    
    Commit 08a0063df3ae ("net/sched: flower: Move filter handle initialization
    earlier") moved filter handle initialization but an assignment of
    the handle to fnew->handle is done regardless of fold value. This is wrong
    because if fold != NULL (so fold->handle == handle) no new handle is
    allocated and passed handle is assigned to fnew->handle. Then if any
    subsequent action in fl_change() fails then the handle value is
    removed from IDR that is incorrect as we will have still valid old filter
    instance with handle that is not present in IDR.
    Fix this issue by moving the assignment so it is done only when passed
    fold == NULL.
    
    Prior the patch:
    [root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be
    Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances
    exit: 123
    exit: 0
    RTNETLINK answers: Invalid argument
    We have an error talking to the kernel
    Command failed tmp/replace_6:1885
    
    All test results:
    
    1..1
    not ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances
            Command exited with 123, expected 0
    RTNETLINK answers: Invalid argument
    We have an error talking to the kernel
    Command failed tmp/replace_6:1885
    
    After the patch:
    [root@machine tc-testing]# ./tdc.py -d enp1s0f0np0 -e 14be
    Test 14be: Concurrently replace same range of 100k flower filters from 10 tc instances
    
    All test results:
    
    1..1
    ok 1 14be - Concurrently replace same range of 100k flower filters from 10 tc instances
    
    Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier")
    Signed-off-by: Ivan Vecera <ivecera@xxxxxxxxxx>
    Reviewed-by: Simon Horman <simon.horman@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230425140604.169881-1-ivecera@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 475fe222a8556..fa6c2bb0b6267 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -2231,8 +2231,8 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
 			kfree(fnew);
 			goto errout_tb;
 		}
+		fnew->handle = handle;
 	}
-	fnew->handle = handle;
 
 	err = tcf_exts_init_ex(&fnew->exts, net, TCA_FLOWER_ACT, 0, tp, handle,
 			       !tc_skip_hw(fnew->flags));