Re: [PATCH net] net/sched: cls_u32: skip hash tables in u32_bind_class()

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Fri, 7 Aug 2026 15:50:38 +0800 you wrote:
> u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode
> through the walker callback. u32_bind_class() unconditionally casts the
> passed fh to tc_u_knode and accesses &n->res, so when fh is actually a
> tc_u_hnode, which has no tcf_result member, this results in a
> slab-out-of-bounds read of res->classid in tc_cls_bind_class().
> 
> The issue can be reproduced with the following commands:
> 
> [...]

Here is the summary with links:
  - [net] net/sched: cls_u32: skip hash tables in u32_bind_class()
    https://git.kernel.org/netdev/net/c/6d3724e616fa

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html