From: Vlad Buslov <vladbu@nvidia.com>
To: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: <davem@davemloft.net>, <jhs@mojatatu.com>, <jiri@resnulli.us>,
<kuba@kernel.org>, <linux-kernel@vger.kernel.org>,
<netdev@vger.kernel.org>, <toke@redhat.com>,
<xiyou.wangcong@gmail.com>
Subject: Re: [PATCH v2 1/1] net: sched: bump refcount for new action in ACT replace mode
Date: Tue, 30 Mar 2021 13:32:35 +0300 [thread overview]
Message-ID: <ygnhblb1gce4.fsf@nvidia.com> (raw)
In-Reply-To: <20210329225322.143135-1-memxor@gmail.com>
On Tue 30 Mar 2021 at 01:53, Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
> Currently, action creation using ACT API in replace mode is buggy.
> When invoking for non-existent action index 42,
>
> tc action replace action bpf obj foo.o sec <xyz> index 42
>
> kernel creates the action, fills up the netlink response, and then just
> deletes the action after notifying userspace.
>
> tc action show action bpf
>
> doesn't list the action.
Okay, I understand the issue now. I'll also add a tdc test for it.
>
> This happens due to the following sequence when ovr = 1 (replace mode)
> is enabled:
>
> tcf_idr_check_alloc is used to atomically check and either obtain
> reference for existing action at index, or reserve the index slot using
> a dummy entry (ERR_PTR(-EBUSY)).
>
> This is necessary as pointers to these actions will be held after
> dropping the idrinfo lock, so bumping the reference count is necessary
> as we need to insert the actions, and notify userspace by dumping their
> attributes. Finally, we drop the reference we took using the
> tcf_action_put_many call in tcf_action_add. However, for the case where
> a new action is created due to free index, its refcount remains one.
> This when paired with the put_many call leads to the kernel setting up
> the action, notifying userspace of its creation, and then tearing it
> down. For existing actions, the refcount is still held so they remain
> unaffected.
>
> Fortunately due to rtnl_lock serialization requirement, such an action
> with refcount == 1 will not be concurrently deleted by anything else, at
> best CLS API can move its refcount up and down by binding to it after it
> has been published from tcf_idr_insert_many. Since refcount is atleast
> one until put_many call, CLS API cannot delete it. Also __tcf_action_put
> release path already ensures deterministic outcome (either new action
> will be created or existing action will be reused in case CLS API tries
> to bind to action concurrently) due to idr lock serialization.
>
> We fix this by making refcount of newly created actions as 2 in ACT API
> replace mode. A relaxed store will suffice as visibility is ensured only
> after the tcf_idr_insert_many call.
>
> Note that in case of creation or overwriting using CLS API only (i.e.
> bind = 1), overwriting existing action object is not allowed, and any
> such request is silently ignored (without error).
>
> The refcount bump that occurs in tcf_idr_check_alloc call there for
> existing action will pair with tcf_exts_destroy call made from the
> owner module for the same action. In case of action creation, there
> is no existing action, so no tcf_exts_destroy callback happens.
>
> This means no code changes for CLS API.
>
> Fixes: cae422f379f3 ("net: sched: use reference counting action init")
> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> ---
> Changelog:
>
> v1 -> v2
> Remove erroneous tcf_action_put_many call in tcf_exts_validate (Vlad)
> Isolate refcount bump to ACT API in replace mode
> ---
> net/sched/act_api.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/sched/act_api.c b/net/sched/act_api.c
> index b919826939e0..43cceb924976 100644
> --- a/net/sched/act_api.c
> +++ b/net/sched/act_api.c
> @@ -1042,6 +1042,9 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,
> if (err != ACT_P_CREATED)
> module_put(a_o->owner);
>
> + if (!bind && ovr && err == ACT_P_CREATED)
> + refcount_set(&a->tcfa_refcnt, 2);
> +
> return a;
>
> err_out:
Reviewed-and-tested-by: Vlad Buslov <vladbu@nvidia.com>
next prev parent reply other threads:[~2021-03-30 10:33 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-29 22:53 [PATCH v2 1/1] net: sched: bump refcount for new action in ACT replace mode Kumar Kartikeya Dwivedi
2021-03-30 10:32 ` Vlad Buslov [this message]
2021-03-30 10:41 ` [PATCH net-next] tc-testing: add simple action change test Vlad Buslov
2021-03-31 0:20 ` patchwork-bot+netdevbpf
2021-03-31 4:40 ` [PATCH v2 1/1] net: sched: bump refcount for new action in ACT replace mode Cong Wang
2021-03-31 7:59 ` Vlad Buslov
2021-03-31 8:37 ` [PATCH net-next v3] " Kumar Kartikeya Dwivedi
2021-03-31 14:08 ` Vlad Buslov
2021-03-31 8:38 ` [PATCH v2 1/1] " Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ygnhblb1gce4.fsf@nvidia.com \
--to=vladbu@nvidia.com \
--cc=davem@davemloft.net \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=toke@redhat.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).