Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6bd00b85 authored by WANG Cong's avatar WANG Cong Committed by David S. Miller
Browse files

act_mirred: fix a race condition on mirred_list 



After commit 1ce87720 ("net: sched: make cls_u32 lockless")
we began to release tc actions in a RCU callback. However,
mirred action relies on RTNL lock to protect the global
mirred_list, therefore we could have a race condition
between RCU callback and netdevice event, which caused
a list corruption as reported by Vinson.

Instead of relying on RTNL lock, introduce a spinlock to
protect this list.

Note, in non-bind case, it is still called with RTNL lock,
therefore should disable BH too.

Reported-by: default avatarVinson Lee <vlee@twopensource.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarCong Wang <cwang@twopensource.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fec31fff

net/sched/act_mirred.c

+10 −1
Original line number Diff line number Diff line
@@ -31,13 +31,17 @@ 


#define MIRRED_TAB_MASK     7

static LIST_HEAD(mirred_list);

static DEFINE_SPINLOCK(mirred_list_lock);



static void tcf_mirred_release(struct tc_action *a, int bind)

{

	struct tcf_mirred *m = to_mirred(a);

	struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);



	/* We could be called either in a RCU callback or with RTNL lock held. */

	spin_lock_bh(&mirred_list_lock);

	list_del(&m->tcfm_list);

	spin_unlock_bh(&mirred_list_lock);

	if (dev)

		dev_put(dev);

}
@@ -123,7 +127,9 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla, 
	}



	if (ret == ACT_P_CREATED) {

		spin_lock_bh(&mirred_list_lock);

		list_add(&m->tcfm_list, &mirred_list);

		spin_unlock_bh(&mirred_list_lock);

		tcf_hash_insert(a);

	}
@@ -221,7 +227,8 @@ static int mirred_device_event(struct notifier_block *unused, 
	struct tcf_mirred *m;



	ASSERT_RTNL();

	if (event == NETDEV_UNREGISTER)

	if (event == NETDEV_UNREGISTER) {

		spin_lock_bh(&mirred_list_lock);

		list_for_each_entry(m, &mirred_list, tcfm_list) {

			if (rcu_access_pointer(m->tcfm_dev) == dev) {

				dev_put(dev);
@@ -231,6 +238,8 @@ static int mirred_device_event(struct notifier_block *unused, 
				RCU_INIT_POINTER(m->tcfm_dev, NULL);

			}

		}

		spin_unlock_bh(&mirred_list_lock);

	}



	return NOTIFY_DONE;

}