renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-13 15:53:56 +08:00
Code

act_mirred: fix a race condition on mirred_list

Browse Source 
After commit 1ce87720d4 ("net: sched: make cls_u32 lockless")
we began to release tc actions in a RCU callback. However,
mirred action relies on RTNL lock to protect the global
mirred_list, therefore we could have a race condition
between RCU callback and netdevice event, which caused
a list corruption as reported by Vinson.

Instead of relying on RTNL lock, introduce a spinlock to
protect this list.

Note, in non-bind case, it is still called with RTNL lock,
therefore should disable BH too.

Reported-by: Vinson Lee <vlee@twopensource.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
WANG Cong 2015-10-01 11:37:42 -07:00 committed by David S. Miller
parent fec31ffffa
commit 6bd00b8506
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/sched/act_mirred.c
View File

@ -31,13 +31,17 @@
#define MIRRED_TAB_MASK 7 #define MIRRED_TAB_MASK 7
static LIST_HEAD(mirred_list); static LIST_HEAD(mirred_list);
static DEFINE_SPINLOCK(mirred_list_lock);
static void tcf_mirred_release(struct tc_action *a, int bind) static void tcf_mirred_release(struct tc_action *a, int bind)
{ {
struct tcf_mirred *m = to_mirred(a); struct tcf_mirred *m = to_mirred(a);
struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1); struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);
/* We could be called either in a RCU callback or with RTNL lock held. */
spin_lock_bh(&mirred_list_lock);
list_del(&m->tcfm_list); list_del(&m->tcfm_list);
spin_unlock_bh(&mirred_list_lock);
if (dev) if (dev)
dev_put(dev); dev_put(dev);
} }
@ -123,7 +127,9 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
} }
if (ret == ACT_P_CREATED) { if (ret == ACT_P_CREATED) {
spin_lock_bh(&mirred_list_lock);
list_add(&m->tcfm_list, &mirred_list); list_add(&m->tcfm_list, &mirred_list);
spin_unlock_bh(&mirred_list_lock);
tcf_hash_insert(a); tcf_hash_insert(a);
} }
@ -221,7 +227,8 @@ static int mirred_device_event(struct notifier_block *unused,
struct tcf_mirred *m; struct tcf_mirred *m;
ASSERT_RTNL(); ASSERT_RTNL();
if (event == NETDEV_UNREGISTER) if (event == NETDEV_UNREGISTER) {
spin_lock_bh(&mirred_list_lock);
list_for_each_entry(m, &mirred_list, tcfm_list) { list_for_each_entry(m, &mirred_list, tcfm_list) {
if (rcu_access_pointer(m->tcfm_dev) == dev) { if (rcu_access_pointer(m->tcfm_dev) == dev) {
dev_put(dev); dev_put(dev);
@ -231,6 +238,8 @@ static int mirred_device_event(struct notifier_block *unused,
RCU_INIT_POINTER(m->tcfm_dev, NULL); RCU_INIT_POINTER(m->tcfm_dev, NULL);
} }
} }
spin_unlock_bh(&mirred_list_lock);
}
return NOTIFY_DONE; return NOTIFY_DONE;
} }