Commit b2fb01f4 authored Dec 20, 2017 by Cong Wang Committed by David S. Miller Dec 26, 2017

net_sched: fix a missing rcu barrier in mini_qdisc_pair_swap()



The rcu_barrier_bh() in mini_qdisc_pair_swap() is to wait for
flying RCU callback installed by a previous mini_qdisc_pair_swap(),
however we miss it on the tp_head==NULL path, which leads to that
the RCU callback still uses miniq_old->rcu after it is freed together
with qdisc in qdisc_graft(). So just add it on that path too.

Fixes: 46209401 ("net: core: introduce mini_Qdisc and eliminate usage of tp->q for clsact fastpath ")
Reported-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Tested-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Cc: Jiri Pirko <jiri@mellanox.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c1a8d0a3

net/sched/sch_generic.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1040,6 +1040,8 @@ void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,

	if (!tp_head) {		if (!tp_head) {
	RCU_INIT_POINTER(*miniqp->p_miniq, NULL);		RCU_INIT_POINTER(*miniqp->p_miniq, NULL);
			/* Wait for flying RCU callback before it is freed. */
			rcu_barrier_bh();
	return;		return;
	}		}

	@@ -1055,7 +1057,7 @@ void mini_qdisc_pair_swap(struct mini_Qdisc_pair *miniqp,
	rcu_assign_pointer(*miniqp->p_miniq, miniq);		rcu_assign_pointer(*miniqp->p_miniq, miniq);

	if (miniq_old)		if (miniq_old)
	/* This is counterpart of the rcu barrier above. We need to		/* This is counterpart of the rcu barriers above. We need to
	* block potential new user of miniq_old until all readers		* block potential new user of miniq_old until all readers
	* are not seeing it.		* are not seeing it.
	*/		*/