From: Paul Menzel <pmenzel@molgen.mpg.de>
To: Jamal Hadi Salim <jhs@mojatatu.com>,
Cong Wang <xiyou.wangcong@gmail.com>,
Jiri Pirko <jiri@resnulli.us>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>
Cc: Serhiy Boiko <serhiy.boiko@plvision.eu>,
Paul Menzel <pmenzel@molgen.mpg.de>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] net: sched: fix infinite loop when trying to create tcf rule
Date: Wed, 13 Oct 2021 23:09:59 +0200 [thread overview]
Message-ID: <20211013211000.8962-1-pmenzel@molgen.mpg.de> (raw)
From: Serhiy Boiko <serhiy.boiko@plvision.eu>
After running a specific set of commands tc will become unresponsive:
$ ip link add dev DEV type veth
$ tc qdisc add dev DEV clsact
$ tc chain add dev DEV chain 0 ingress
$ tc filter del dev DEV ingress
$ tc filter add dev DEV ingress flower action pass
When executing chain flush the chain->flushing field is set to true, which
prevents insertion of new classifier instances. It is unset in one place
under two conditions: `refcnt - chain->action_refcnt == 0` and `!by_act`.
Ignoring the by_act and action_refcnt arguments the `flushing procedure`
will be over when refcnt is 0.
But if the chain is explicitly created (e.g. `tc chain add .. chain 0 ..`)
refcnt is set to 1 without any classifier instances. Thus the condition is
never met and the chain->flushing field is never cleared. And because the
default chain is `flushing` new classifiers cannot be added. tc_new_tfilter
is stuck in a loop trying to find a chain where chain->flushing is false.
Moving `chain->flushing = false` from __tcf_chain_put to the end of
tcf_chain_flush will avoid the condition and the field will always be reset
after the flush procedure.
Signed-off-by: Serhiy Boiko <serhiy.boiko@plvision.eu>
[Upstreamed from https://github.com/dentproject/dentOS/commit/3480aceaa5244a11edfe1fda90afd92b0199ef23]
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
---
net/sched/cls_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 2ef8f5a6205a..405f955bef1e 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -563,8 +563,6 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
if (refcnt - chain->action_refcnt == 0 && !by_act) {
tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index,
block, NULL, 0, 0, false);
- /* Last reference to chain, no need to lock. */
- chain->flushing = false;
}
if (refcnt == 0)
@@ -615,6 +613,9 @@ static void tcf_chain_flush(struct tcf_chain *chain, bool rtnl_held)
tcf_proto_put(tp, rtnl_held, NULL);
tp = tp_next;
}
+
+ /* Last reference to chain, no need to lock. */
+ chain->flushing = false;
}
static int tcf_block_setup(struct tcf_block *block,
--
2.33.0
reply other threads:[~2021-10-13 21:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211013211000.8962-1-pmenzel@molgen.mpg.de \
--to=pmenzel@molgen.mpg.de \
--cc=davem@davemloft.net \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=serhiy.boiko@plvision.eu \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).