From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Taehee Yoo <ap420073@gmail.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.17 48/63] rhashtable: add restart routine in rhashtable_free_and_destroy()
Date: Mon, 23 Jul 2018 14:24:54 +0200 [thread overview]
Message-ID: <20180723122448.183927751@linuxfoundation.org> (raw)
In-Reply-To: <20180723122446.351334162@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 0026129c8629265bfe5079c1e017fa8543796d9f ]
rhashtable_free_and_destroy() cancels re-hash deferred work
then walks and destroys elements. at this moment, some elements can be
still in future_tbl. that elements are not destroyed.
test case:
nft_rhash_destroy() calls rhashtable_free_and_destroy() to destroy
all elements of sets before destroying sets and chains.
But rhashtable_free_and_destroy() doesn't destroy elements of future_tbl.
so that splat occurred.
test script:
%cat test.nft
table ip aa {
map map1 {
type ipv4_addr : verdict;
elements = {
0 : jump a0,
1 : jump a0,
2 : jump a0,
3 : jump a0,
4 : jump a0,
5 : jump a0,
6 : jump a0,
7 : jump a0,
8 : jump a0,
9 : jump a0,
}
}
chain a0 {
}
}
flush ruleset
table ip aa {
map map1 {
type ipv4_addr : verdict;
elements = {
0 : jump a0,
1 : jump a0,
2 : jump a0,
3 : jump a0,
4 : jump a0,
5 : jump a0,
6 : jump a0,
7 : jump a0,
8 : jump a0,
9 : jump a0,
}
}
chain a0 {
}
}
flush ruleset
%while :; do nft -f test.nft; done
Splat looks like:
[ 200.795603] kernel BUG at net/netfilter/nf_tables_api.c:1363!
[ 200.806944] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 200.812253] CPU: 1 PID: 1582 Comm: nft Not tainted 4.17.0+ #24
[ 200.820297] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015
[ 200.830309] RIP: 0010:nf_tables_chain_destroy.isra.34+0x62/0x240 [nf_tables]
[ 200.838317] Code: 43 50 85 c0 74 26 48 8b 45 00 48 8b 4d 08 ba 54 05 00 00 48 c7 c6 60 6d 29 c0 48 c7 c7 c0 65 29 c0 4c 8b 40 08 e8 58 e5 fd f8 <0f> 0b 48 89 da 48 b8 00 00 00 00 00 fc ff
[ 200.860366] RSP: 0000:ffff880118dbf4d0 EFLAGS: 00010282
[ 200.866354] RAX: 0000000000000061 RBX: ffff88010cdeaf08 RCX: 0000000000000000
[ 200.874355] RDX: 0000000000000061 RSI: 0000000000000008 RDI: ffffed00231b7e90
[ 200.882361] RBP: ffff880118dbf4e8 R08: ffffed002373bcfb R09: ffffed002373bcfa
[ 200.890354] R10: 0000000000000000 R11: ffffed002373bcfb R12: dead000000000200
[ 200.898356] R13: dead000000000100 R14: ffffffffbb62af38 R15: dffffc0000000000
[ 200.906354] FS: 00007fefc31fd700(0000) GS:ffff88011b800000(0000) knlGS:0000000000000000
[ 200.915533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 200.922355] CR2: 0000557f1c8e9128 CR3: 0000000106880000 CR4: 00000000001006e0
[ 200.930353] Call Trace:
[ 200.932351] ? nf_tables_commit+0x26f6/0x2c60 [nf_tables]
[ 200.939525] ? nf_tables_setelem_notify.constprop.49+0x1a0/0x1a0 [nf_tables]
[ 200.947525] ? nf_tables_delchain+0x6e0/0x6e0 [nf_tables]
[ 200.952383] ? nft_add_set_elem+0x1700/0x1700 [nf_tables]
[ 200.959532] ? nla_parse+0xab/0x230
[ 200.963529] ? nfnetlink_rcv_batch+0xd06/0x10d0 [nfnetlink]
[ 200.968384] ? nfnetlink_net_init+0x130/0x130 [nfnetlink]
[ 200.975525] ? debug_show_all_locks+0x290/0x290
[ 200.980363] ? debug_show_all_locks+0x290/0x290
[ 200.986356] ? sched_clock_cpu+0x132/0x170
[ 200.990352] ? find_held_lock+0x39/0x1b0
[ 200.994355] ? sched_clock_local+0x10d/0x130
[ 200.999531] ? memset+0x1f/0x40
V2:
- free all tables requested by Herbert Xu
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/rhashtable.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -1107,13 +1107,14 @@ void rhashtable_free_and_destroy(struct
void (*free_fn)(void *ptr, void *arg),
void *arg)
{
- struct bucket_table *tbl;
+ struct bucket_table *tbl, *next_tbl;
unsigned int i;
cancel_work_sync(&ht->run_work);
mutex_lock(&ht->mutex);
tbl = rht_dereference(ht->tbl, ht);
+restart:
if (free_fn) {
for (i = 0; i < tbl->size; i++) {
struct rhash_head *pos, *next;
@@ -1130,7 +1131,12 @@ void rhashtable_free_and_destroy(struct
}
}
+ next_tbl = rht_dereference(tbl->future_tbl, ht);
bucket_table_free(tbl);
+ if (next_tbl) {
+ tbl = next_tbl;
+ goto restart;
+ }
mutex_unlock(&ht->mutex);
}
EXPORT_SYMBOL_GPL(rhashtable_free_and_destroy);
next prev parent reply other threads:[~2018-07-23 12:27 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-23 12:24 [PATCH 4.17 00/63] 4.17.10-stable review Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 01/63] scsi: sd_zbc: Fix variable type and bogus comment Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 02/63] scsi: qla2xxx: Fix inconsistent DMA mem alloc/free Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 03/63] scsi: qla2xxx: Fix kernel crash due to late workqueue allocation Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 04/63] scsi: qla2xxx: Fix NULL pointer dereference for fcport search Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 06/63] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 07/63] KVM: VMX: Mark VMXArea with revision_id of physical CPU even when eVMCS enabled Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 08/63] x86/kvm/vmx: dont read current->thread.{fs,gs}base of legacy tasks Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 11/63] x86/events/intel/ds: Fix bts_interrupt_threshold alignment Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 12/63] x86/MCE: Remove min interval polling limitation Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 13/63] fat: fix memory allocation failure handling of match_strdup() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 14/63] ALSA: rawmidi: Change resized buffers atomically Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 15/63] ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 16/63] ALSA: hda/realtek - Yet another Clevo P950 quirk entry Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 17/63] ALSA: hda: add mute led support for HP ProBook 455 G5 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 18/63] ARCv2: [plat-hsdk]: Save accl reg pair by default Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 19/63] ARC: Fix CONFIG_SWAP Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 20/63] ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 21/63] ARC: mm: allow mprotect to make stack mappings executable Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 22/63] mm: memcg: fix use after free in mem_cgroup_iter() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 23/63] mm/huge_memory.c: fix data loss when splitting a file pmd Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 24/63] cpufreq: intel_pstate: Register when ACPI PCCH is present Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 25/63] vfio/pci: Fix potential Spectre v1 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 26/63] vfio/spapr: Use IOMMU pageshift rather than pagesize Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 27/63] stop_machine: Disable preemption when waking two stopper threads Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 28/63] powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from stop (idle) Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 31/63] Revert "drm/amd/display: Dont return ddc result and read_bytes in same return value" Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 32/63] drm/nouveau: Remove bogus crtc check in pmops_runtime_idle Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 33/63] drm/nouveau: Use drm_connector_list_iter_* for iterating connectors Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 34/63] drm/nouveau: Avoid looping through fake MST connectors Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 36/63] ipv4: Return EINVAL when ping_group_range sysctl doesnt map to user ns Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 37/63] ipv6: fix useless rol32 call on hash Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 38/63] ipv6: ila: select CONFIG_DST_CACHE Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 39/63] lib/rhashtable: consider param->min_size when setting initial table size Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 40/63] net: diag: Dont double-free TCP_NEW_SYN_RECV sockets in tcp_abort Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 41/63] net: Dont copy pfmemalloc flag in __copy_skb_header() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 42/63] skbuff: Unconditionally copy pfmemalloc in __skb_clone() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 43/63] net/ipv4: Set oif in fib_compute_spec_dst Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 44/63] net/ipv6: Do not allow device only routes via the multipath API Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 45/63] net: phy: fix flag masking in __set_phy_supported Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 46/63] ptp: fix missing break in switch Greg Kroah-Hartman
2018-07-23 12:24 ` Greg Kroah-Hartman [this message]
2018-07-23 12:24 ` [PATCH 4.17 49/63] sch_fq_codel: zero q->flows_cnt when fq_codel_init fails Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 50/63] tg3: Add higher cpu clock for 5762 Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 51/63] net: ip6_gre: get ipv6hdr after skb_cow_head() Greg Kroah-Hartman
2018-07-23 12:24 ` [PATCH 4.17 52/63] sctp: introduce sctp_dst_mtu Greg Kroah-Hartman
2018-07-25 19:19 ` Marcelo Ricardo Leitner
2018-07-23 12:24 ` [PATCH 4.17 53/63] sctp: fix the issue that pathmtu may be set lower than MINSEGMENT Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 54/63] hv_netvsc: Fix napi reschedule while receive completion is busy Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 55/63] net: aquantia: vlan unicast address list correct handling Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 56/63] net/mlx4_en: Dont reuse RX page when XDP is set Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 57/63] net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 58/63] ipv6: make DAD fail with enhanced DAD when nonce length differs Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 59/63] net: usb: asix: replace mii_nway_restart in resume path Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 60/63] alpha: fix osf_wait4() breakage Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 61/63] drm_mode_create_lease_ioctl(): fix open-coded filp_clone_open() Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 62/63] cxl_getfile(): fix double-iput() on alloc_file() failures Greg Kroah-Hartman
2018-07-23 12:25 ` [PATCH 4.17 63/63] xhci: Fix perceived dead host due to runtime suspend race with event handler Greg Kroah-Hartman
2018-07-24 7:38 ` [PATCH 4.17 00/63] 4.17.10-stable review Naresh Kamboju
2018-07-24 8:58 ` Greg Kroah-Hartman
2018-07-24 15:58 ` Guenter Roeck
2018-07-25 7:46 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180723122448.183927751@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ap420073@gmail.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).