* [PATCH net v2 0/3] Action initalization fixes
@ 2021-04-07 15:36 Vlad Buslov
2021-04-07 15:36 ` [PATCH net v2 1/3] Revert "net: sched: bump refcount for new action in ACT replace mode" Vlad Buslov
` (3 more replies)
0 siblings, 4 replies; 11+ messages in thread
From: Vlad Buslov @ 2021-04-07 15:36 UTC (permalink / raw)
To: netdev
Cc: memxor, xiyou.wangcong, davem, jhs, jiri, kuba, toke,
marcelo.leitner, dcaratti, Vlad Buslov
This series fixes reference counting of action instances and modules in
several parts of action init code. The first patch reverts previous fix
that didn't properly account for rollback from a failure in the middle of
the loop in tcf_action_init() which is properly fixed by the following
patch.
Vlad Buslov (3):
Revert "net: sched: bump refcount for new action in ACT replace mode"
net: sched: fix action overwrite reference counting
net: sched: fix err handler in tcf_action_init()
include/net/act_api.h | 12 ++++------
net/sched/act_api.c | 51 ++++++++++++++++++++++++++-----------------
net/sched/cls_api.c | 14 ++++++------
3 files changed, 42 insertions(+), 35 deletions(-)
--
2.29.2
^ permalink raw reply [flat|nested] 11+ messages in thread* [PATCH net v2 1/3] Revert "net: sched: bump refcount for new action in ACT replace mode" 2021-04-07 15:36 [PATCH net v2 0/3] Action initalization fixes Vlad Buslov @ 2021-04-07 15:36 ` Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 2/3] net: sched: fix action overwrite reference counting Vlad Buslov ` (2 subsequent siblings) 3 siblings, 0 replies; 11+ messages in thread From: Vlad Buslov @ 2021-04-07 15:36 UTC (permalink / raw) To: netdev Cc: memxor, xiyou.wangcong, davem, jhs, jiri, kuba, toke, marcelo.leitner, dcaratti, Vlad Buslov This reverts commit 6855e8213e06efcaf7c02a15e12b1ae64b9a7149. Following commit in series fixes the issue without introducing regression in error rollback of tcf_action_destroy(). Signed-off-by: Vlad Buslov <vladbu@nvidia.com> --- net/sched/act_api.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 43cceb924976..b919826939e0 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -1042,9 +1042,6 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, if (err != ACT_P_CREATED) module_put(a_o->owner); - if (!bind && ovr && err == ACT_P_CREATED) - refcount_set(&a->tcfa_refcnt, 2); - return a; err_out: -- 2.29.2 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-07 15:36 [PATCH net v2 0/3] Action initalization fixes Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 1/3] Revert "net: sched: bump refcount for new action in ACT replace mode" Vlad Buslov @ 2021-04-07 15:36 ` Vlad Buslov 2021-04-07 23:50 ` Cong Wang 2021-04-07 15:36 ` [PATCH net v2 3/3] net: sched: fix err handler in tcf_action_init() Vlad Buslov 2021-04-08 22:02 ` [PATCH net v2 0/3] Action initalization fixes Cong Wang 3 siblings, 1 reply; 11+ messages in thread From: Vlad Buslov @ 2021-04-07 15:36 UTC (permalink / raw) To: netdev Cc: memxor, xiyou.wangcong, davem, jhs, jiri, kuba, toke, marcelo.leitner, dcaratti, Vlad Buslov Action init code increments reference counter when it changes an action. This is the desired behavior for cls API which needs to obtain action reference for every classifier that points to action. However, act API just needs to change the action and releases the reference before returning. This sequence breaks when the requested action doesn't exist, which causes act API init code to create new action with specified index, but action is still released before returning and is deleted (unless it was referenced concurrently by cls API). Reproduction: $ sudo tc actions ls action gact $ sudo tc actions change action gact drop index 1 $ sudo tc actions ls action gact Extend tcf_action_init() to accept 'init_res' array and initialize it with action->ops->init() result. In tcf_action_add() remove pointers to created actions from actions array before passing it to tcf_action_put_many(). Fixes: cae422f379f3 ("net: sched: use reference counting action init") Reported-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Vlad Buslov <vladbu@nvidia.com> --- Notes: Changes V1 -> V2: - Extend commit message with reproduction and fix details. - Don't extend tcf_action_put_many() with action filtering. Filter actions array in caller instead. include/net/act_api.h | 5 +++-- net/sched/act_api.c | 22 +++++++++++++++------- net/sched/cls_api.c | 9 +++++---- 3 files changed, 23 insertions(+), 13 deletions(-) diff --git a/include/net/act_api.h b/include/net/act_api.h index 2bf3092ae7ec..312f0f6554a0 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -185,7 +185,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions, int nr_actions, struct tcf_result *res); int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla, struct nlattr *est, char *name, int ovr, int bind, - struct tc_action *actions[], size_t *attr_size, + struct tc_action *actions[], int init_res[], size_t *attr_size, bool rtnl_held, struct netlink_ext_ack *extack); struct tc_action_ops *tc_action_load_ops(char *name, struct nlattr *nla, bool rtnl_held, @@ -193,7 +193,8 @@ struct tc_action_ops *tc_action_load_ops(char *name, struct nlattr *nla, struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, struct nlattr *nla, struct nlattr *est, char *name, int ovr, int bind, - struct tc_action_ops *ops, bool rtnl_held, + struct tc_action_ops *a_o, int *init_res, + bool rtnl_held, struct netlink_ext_ack *extack); int tcf_action_dump(struct sk_buff *skb, struct tc_action *actions[], int bind, int ref, bool terse); diff --git a/net/sched/act_api.c b/net/sched/act_api.c index b919826939e0..50854cfbfcdb 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -992,7 +992,8 @@ struct tc_action_ops *tc_action_load_ops(char *name, struct nlattr *nla, struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, struct nlattr *nla, struct nlattr *est, char *name, int ovr, int bind, - struct tc_action_ops *a_o, bool rtnl_held, + struct tc_action_ops *a_o, int *init_res, + bool rtnl_held, struct netlink_ext_ack *extack) { struct nla_bitfield32 flags = { 0, 0 }; @@ -1028,6 +1029,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, } if (err < 0) goto err_out; + *init_res = err; if (!name && tb[TCA_ACT_COOKIE]) tcf_set_action_cookie(&a->act_cookie, cookie); @@ -1056,7 +1058,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla, struct nlattr *est, char *name, int ovr, int bind, - struct tc_action *actions[], size_t *attr_size, + struct tc_action *actions[], int init_res[], size_t *attr_size, bool rtnl_held, struct netlink_ext_ack *extack) { struct tc_action_ops *ops[TCA_ACT_MAX_PRIO] = {}; @@ -1084,7 +1086,8 @@ int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla, for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) { act = tcf_action_init_1(net, tp, tb[i], est, name, ovr, bind, - ops[i - 1], rtnl_held, extack); + ops[i - 1], &init_res[i - 1], rtnl_held, + extack); if (IS_ERR(act)) { err = PTR_ERR(act); goto err; @@ -1497,12 +1500,13 @@ static int tcf_action_add(struct net *net, struct nlattr *nla, struct netlink_ext_ack *extack) { size_t attr_size = 0; - int loop, ret; + int loop, ret, i; struct tc_action *actions[TCA_ACT_MAX_PRIO] = {}; + int init_res[TCA_ACT_MAX_PRIO] = {}; for (loop = 0; loop < 10; loop++) { ret = tcf_action_init(net, NULL, nla, NULL, NULL, ovr, 0, - actions, &attr_size, true, extack); + actions, init_res, &attr_size, true, extack); if (ret != -EAGAIN) break; } @@ -1510,8 +1514,12 @@ static int tcf_action_add(struct net *net, struct nlattr *nla, if (ret < 0) return ret; ret = tcf_add_notify(net, n, actions, portid, attr_size, extack); - if (ovr) - tcf_action_put_many(actions); + + /* only put existing actions */ + for (i = 0; i < TCA_ACT_MAX_PRIO; i++) + if (init_res[i] == ACT_P_CREATED) + actions[i] = NULL; + tcf_action_put_many(actions); return ret; } diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 9332ec6863e8..9ecb91ebf094 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -3040,6 +3040,7 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, { #ifdef CONFIG_NET_CLS_ACT { + int init_res[TCA_ACT_MAX_PRIO] = {}; struct tc_action *act; size_t attr_size = 0; @@ -3051,8 +3052,8 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, return PTR_ERR(a_o); act = tcf_action_init_1(net, tp, tb[exts->police], rate_tlv, "police", ovr, - TCA_ACT_BIND, a_o, rtnl_held, - extack); + TCA_ACT_BIND, a_o, init_res, + rtnl_held, extack); if (IS_ERR(act)) { module_put(a_o->owner); return PTR_ERR(act); @@ -3067,8 +3068,8 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, err = tcf_action_init(net, tp, tb[exts->action], rate_tlv, NULL, ovr, TCA_ACT_BIND, - exts->actions, &attr_size, - rtnl_held, extack); + exts->actions, init_res, + &attr_size, rtnl_held, extack); if (err < 0) return err; exts->nr_actions = err; -- 2.29.2 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-07 15:36 ` [PATCH net v2 2/3] net: sched: fix action overwrite reference counting Vlad Buslov @ 2021-04-07 23:50 ` Cong Wang 2021-04-08 7:50 ` Vlad Buslov 2021-04-08 11:59 ` Jamal Hadi Salim 0 siblings, 2 replies; 11+ messages in thread From: Cong Wang @ 2021-04-07 23:50 UTC (permalink / raw) To: Vlad Buslov Cc: Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jamal Hadi Salim, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On Wed, Apr 7, 2021 at 8:36 AM Vlad Buslov <vladbu@nvidia.com> wrote: > > Action init code increments reference counter when it changes an action. > This is the desired behavior for cls API which needs to obtain action > reference for every classifier that points to action. However, act API just > needs to change the action and releases the reference before returning. > This sequence breaks when the requested action doesn't exist, which causes > act API init code to create new action with specified index, but action is > still released before returning and is deleted (unless it was referenced > concurrently by cls API). > > Reproduction: > > $ sudo tc actions ls action gact > $ sudo tc actions change action gact drop index 1 > $ sudo tc actions ls action gact > I didn't know 'change' could actually create an action when it does not exist. So it sets NLM_F_REPLACE, how could it replace a non-existing one? Is this the right behavior or is it too late to change even if it is not? > Extend tcf_action_init() to accept 'init_res' array and initialize it with > action->ops->init() result. In tcf_action_add() remove pointers to created > actions from actions array before passing it to tcf_action_put_many(). In my last comments, I actually meant whether we can avoid this 'init_res[]' array. Since here you want to check whether an action returned by tcf_action_init_1() is a new one or an existing one, how about checking its refcnt? Something like: act = tcf_action_init_1(...); if (IS_ERR(act)) { err = PTR_ERR(act); goto err; } if (refcount_read(&act->tcfa_refcnt) == 1) { // we know this is a newly allocated one } Thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-07 23:50 ` Cong Wang @ 2021-04-08 7:50 ` Vlad Buslov 2021-04-08 13:43 ` Jamal Hadi Salim 2021-04-08 21:52 ` Cong Wang 2021-04-08 11:59 ` Jamal Hadi Salim 1 sibling, 2 replies; 11+ messages in thread From: Vlad Buslov @ 2021-04-08 7:50 UTC (permalink / raw) To: Cong Wang, Jamal Hadi Salim Cc: Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On Thu 08 Apr 2021 at 02:50, Cong Wang <xiyou.wangcong@gmail.com> wrote: > On Wed, Apr 7, 2021 at 8:36 AM Vlad Buslov <vladbu@nvidia.com> wrote: >> >> Action init code increments reference counter when it changes an action. >> This is the desired behavior for cls API which needs to obtain action >> reference for every classifier that points to action. However, act API just >> needs to change the action and releases the reference before returning. >> This sequence breaks when the requested action doesn't exist, which causes >> act API init code to create new action with specified index, but action is >> still released before returning and is deleted (unless it was referenced >> concurrently by cls API). >> >> Reproduction: >> >> $ sudo tc actions ls action gact >> $ sudo tc actions change action gact drop index 1 >> $ sudo tc actions ls action gact >> > > I didn't know 'change' could actually create an action when > it does not exist. So it sets NLM_F_REPLACE, how could it > replace a non-existing one? Is this the right behavior or is it too > late to change even if it is not? Origins of setting ovr based on NLM_F_REPLACE are lost since this code goes back to Linus' Linux-2.6.12-rc2 commit. Jamal, do you know if this is the expected behavior or just something unintended? > >> Extend tcf_action_init() to accept 'init_res' array and initialize it with >> action->ops->init() result. In tcf_action_add() remove pointers to created >> actions from actions array before passing it to tcf_action_put_many(). > > In my last comments, I actually meant whether we can avoid this > 'init_res[]' array. Since here you want to check whether an action > returned by tcf_action_init_1() is a new one or an existing one, how > about checking its refcnt? Something like: > > act = tcf_action_init_1(...); > if (IS_ERR(act)) { > err = PTR_ERR(act); > goto err; > } > if (refcount_read(&act->tcfa_refcnt) == 1) { > // we know this is a newly allocated one > } > > Thanks. Hmm, I don't think this would work in general case. Consider following cases: 1. Action existed during init as filter action(refcnt=1), init overwrote it setting refcnt=2, by the time we got to checking tcfa_refcnt filter has been deleted (refcnt=1) so code will incorrectly assume that it has created the action. 2. We need this check in tcf_action_add() to release the refcnt in case of overwriting existing actions, but by that time actions are already accessible though idr, so even in case when new action has been created (refcnt=1) it could already been referenced by concurrently created filter (refcnt=2). Regards, Vlad ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-08 7:50 ` Vlad Buslov @ 2021-04-08 13:43 ` Jamal Hadi Salim 2021-04-08 21:52 ` Cong Wang 1 sibling, 0 replies; 11+ messages in thread From: Jamal Hadi Salim @ 2021-04-08 13:43 UTC (permalink / raw) To: Vlad Buslov, Cong Wang Cc: Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On 2021-04-08 3:50 a.m., Vlad Buslov wrote: > > On Thu 08 Apr 2021 at 02:50, Cong Wang <xiyou.wangcong@gmail.com> wrote: > Origins of setting ovr based on NLM_F_REPLACE are lost since this code > goes back to Linus' Linux-2.6.12-rc2 commit. Jamal, do you know if this > is the expected behavior or just something unintended? Seems our emails crossed path. The problem with ovr is the ambiguity of whether we are saying both CREATE and REPLACE or just one or the other. We could improve the kernel side by just passing the flags to each action. Note it is too late to fix iproute2 without some backward compat flag; but it may not be too late for someone writting a new application in user space. cheers, jamal ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-08 7:50 ` Vlad Buslov 2021-04-08 13:43 ` Jamal Hadi Salim @ 2021-04-08 21:52 ` Cong Wang 1 sibling, 0 replies; 11+ messages in thread From: Cong Wang @ 2021-04-08 21:52 UTC (permalink / raw) To: Vlad Buslov Cc: Jamal Hadi Salim, Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On Thu, Apr 8, 2021 at 12:50 AM Vlad Buslov <vladbu@nvidia.com> wrote: > > > On Thu 08 Apr 2021 at 02:50, Cong Wang <xiyou.wangcong@gmail.com> wrote: > > In my last comments, I actually meant whether we can avoid this > > 'init_res[]' array. Since here you want to check whether an action > > returned by tcf_action_init_1() is a new one or an existing one, how > > about checking its refcnt? Something like: > > > > act = tcf_action_init_1(...); > > if (IS_ERR(act)) { > > err = PTR_ERR(act); > > goto err; > > } > > if (refcount_read(&act->tcfa_refcnt) == 1) { > > // we know this is a newly allocated one > > } > > > > Thanks. > > Hmm, I don't think this would work in general case. Consider following > cases: > > 1. Action existed during init as filter action(refcnt=1), init overwrote > it setting refcnt=2, by the time we got to checking tcfa_refcnt filter > has been deleted (refcnt=1) so code will incorrectly assume that it has > created the action. > > 2. We need this check in tcf_action_add() to release the refcnt in case > of overwriting existing actions, but by that time actions are already > accessible though idr, so even in case when new action has been created > (refcnt=1) it could already been referenced by concurrently created > filter (refcnt=2). Hmm, I nearly forgot RTNL is lifted for some cases along TC filter and action control paths... It seems we have no better way to work around this. Thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-07 23:50 ` Cong Wang 2021-04-08 7:50 ` Vlad Buslov @ 2021-04-08 11:59 ` Jamal Hadi Salim 2021-04-08 21:55 ` Cong Wang 1 sibling, 1 reply; 11+ messages in thread From: Jamal Hadi Salim @ 2021-04-08 11:59 UTC (permalink / raw) To: Cong Wang, Vlad Buslov Cc: Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On 2021-04-07 7:50 p.m., Cong Wang wrote: > On Wed, Apr 7, 2021 at 8:36 AM Vlad Buslov <vladbu@nvidia.com> wrote: >> >> Action init code increments reference counter when it changes an action. >> This is the desired behavior for cls API which needs to obtain action >> reference for every classifier that points to action. However, act API just >> needs to change the action and releases the reference before returning. >> This sequence breaks when the requested action doesn't exist, which causes >> act API init code to create new action with specified index, but action is >> still released before returning and is deleted (unless it was referenced >> concurrently by cls API). >> >> Reproduction: >> >> $ sudo tc actions ls action gact >> $ sudo tc actions change action gact drop index 1 >> $ sudo tc actions ls action gact >> > > I didn't know 'change' could actually create an action when > it does not exist. So it sets NLM_F_REPLACE, how could it > replace a non-existing one? Is this the right behavior or is it too > late to change even if it is not? Thats expected behavior for "change" essentially mapping to classical "SET" i.e. "create if it doesnt exist, replace if it exists" i.e NLM_F_CREATE | NLM_F_REPLACE In retrospect, "replace" should probably have been just NLM_F_REPLACE "replace if it exists, error otherwise". Currently there is no distinction between the two. "Add" is classical "CREATE" i.e "create if doesnt exist, otherwise error" It may be feasible to fix "replace" but not sure how many scripts over the years are now dependent on that behavior. cheers, jamal ^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 2/3] net: sched: fix action overwrite reference counting 2021-04-08 11:59 ` Jamal Hadi Salim @ 2021-04-08 21:55 ` Cong Wang 0 siblings, 0 replies; 11+ messages in thread From: Cong Wang @ 2021-04-08 21:55 UTC (permalink / raw) To: Jamal Hadi Salim Cc: Vlad Buslov, Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On Thu, Apr 8, 2021 at 4:59 AM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > On 2021-04-07 7:50 p.m., Cong Wang wrote: > > On Wed, Apr 7, 2021 at 8:36 AM Vlad Buslov <vladbu@nvidia.com> wrote: > >> > >> Action init code increments reference counter when it changes an action. > >> This is the desired behavior for cls API which needs to obtain action > >> reference for every classifier that points to action. However, act API just > >> needs to change the action and releases the reference before returning. > >> This sequence breaks when the requested action doesn't exist, which causes > >> act API init code to create new action with specified index, but action is > >> still released before returning and is deleted (unless it was referenced > >> concurrently by cls API). > >> > >> Reproduction: > >> > >> $ sudo tc actions ls action gact > >> $ sudo tc actions change action gact drop index 1 > >> $ sudo tc actions ls action gact > >> > > > > I didn't know 'change' could actually create an action when > > it does not exist. So it sets NLM_F_REPLACE, how could it > > replace a non-existing one? Is this the right behavior or is it too > > late to change even if it is not? > > Thats expected behavior for "change" essentially mapping > to classical "SET" i.e. > "create if it doesnt exist, replace if it exists" > i.e NLM_F_CREATE | NLM_F_REPLACE > > In retrospect, "replace" should probably have been just NLM_F_REPLACE > "replace if it exists, error otherwise". > Currently there is no distinction between the two. This is how I interpret "replace" too, but again it is probably too late to change. > > "Add" is classical "CREATE" i.e "create if doesnt exist, otherwise > error" > > It may be feasible to fix "replace" but not sure how many scripts over > the years are now dependent on that behavior. Right, we probably have to live with it forever. Thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH net v2 3/3] net: sched: fix err handler in tcf_action_init() 2021-04-07 15:36 [PATCH net v2 0/3] Action initalization fixes Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 1/3] Revert "net: sched: bump refcount for new action in ACT replace mode" Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 2/3] net: sched: fix action overwrite reference counting Vlad Buslov @ 2021-04-07 15:36 ` Vlad Buslov 2021-04-08 22:02 ` [PATCH net v2 0/3] Action initalization fixes Cong Wang 3 siblings, 0 replies; 11+ messages in thread From: Vlad Buslov @ 2021-04-07 15:36 UTC (permalink / raw) To: netdev Cc: memxor, xiyou.wangcong, davem, jhs, jiri, kuba, toke, marcelo.leitner, dcaratti, Vlad Buslov With recent changes that separated action module load from action initialization tcf_action_init() function error handling code was modified to manually release the loaded modules if loading/initialization of any further action in same batch failed. For the case when all modules successfully loaded and some of the actions were initialized before one of them failed in init handler. In this case for all previous actions the module will be released twice by the error handler: First time by the loop that manually calls module_put() for all ops, and second time by the action destroy code that puts the module after destroying the action. Reproduction: $ sudo tc actions add action simple sdata \"2\" index 2 $ sudo tc actions add action simple sdata \"1\" index 1 \ action simple sdata \"2\" index 2 RTNETLINK answers: File exists We have an error talking to the kernel $ sudo tc actions ls action simple total acts 1 action order 0: Simple <"2"> index 2 ref 1 bind 0 $ sudo tc actions flush action simple $ sudo tc actions ls action simple $ sudo tc actions add action simple sdata \"2\" index 2 Error: Failed to load TC action module. We have an error talking to the kernel $ lsmod | grep simple act_simple 20480 -1 Fix the issue by modifying module reference counting handling in action initialization code: - Get module reference in tcf_idr_create() and put it in tcf_idr_release() instead of taking over the reference held by the caller. - Modify users of tcf_action_init_1() to always release the module reference which they obtain before calling init function instead of assuming that created action takes over the reference. - Finally, modify tcf_action_init_1() to not release the module reference when overwriting existing action as this is no longer necessary since both upper and lower layers obtain and manage their own module references independently. Fixes: d349f9976868 ("net_sched: fix RTNL deadlock again caused by request_module()") Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Vlad Buslov <vladbu@nvidia.com> --- Notes: Changes V1 -> V2: - Reimplement the fix to unconditionally release action module references in action create code and modify action idr create/release to manually get/put module reference instead of taking over the reference held by the caller (Cong Wang). include/net/act_api.h | 7 +------ net/sched/act_api.c | 26 ++++++++++++++++---------- net/sched/cls_api.c | 5 ++--- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/include/net/act_api.h b/include/net/act_api.h index 312f0f6554a0..086b291e9530 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -170,12 +170,7 @@ void tcf_idr_insert_many(struct tc_action *actions[]); void tcf_idr_cleanup(struct tc_action_net *tn, u32 index); int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index, struct tc_action **a, int bind); -int __tcf_idr_release(struct tc_action *a, bool bind, bool strict); - -static inline int tcf_idr_release(struct tc_action *a, bool bind) -{ - return __tcf_idr_release(a, bind, false); -} +int tcf_idr_release(struct tc_action *a, bool bind); int tcf_register_action(struct tc_action_ops *a, struct pernet_operations *ops); int tcf_unregister_action(struct tc_action_ops *a, diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 50854cfbfcdb..f6d5755d669e 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -158,7 +158,7 @@ static int __tcf_action_put(struct tc_action *p, bool bind) return 0; } -int __tcf_idr_release(struct tc_action *p, bool bind, bool strict) +static int __tcf_idr_release(struct tc_action *p, bool bind, bool strict) { int ret = 0; @@ -184,7 +184,18 @@ int __tcf_idr_release(struct tc_action *p, bool bind, bool strict) return ret; } -EXPORT_SYMBOL(__tcf_idr_release); + +int tcf_idr_release(struct tc_action *a, bool bind) +{ + const struct tc_action_ops *ops = a->ops; + int ret; + + ret = __tcf_idr_release(a, bind, false); + if (ret == ACT_P_DELETED) + module_put(ops->owner); + return ret; +} +EXPORT_SYMBOL(tcf_idr_release); static size_t tcf_action_shared_attrs_size(const struct tc_action *act) { @@ -493,6 +504,7 @@ int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est, } p->idrinfo = idrinfo; + __module_get(ops->owner); p->ops = ops; *a = p; return 0; @@ -1037,13 +1049,6 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, if (!name) a->hw_stats = hw_stats; - /* module count goes up only when brand new policy is created - * if it exists and is only bound to in a_o->init() then - * ACT_P_CREATED is not returned (a zero is). - */ - if (err != ACT_P_CREATED) - module_put(a_o->owner); - return a; err_out: @@ -1103,7 +1108,8 @@ int tcf_action_init(struct net *net, struct tcf_proto *tp, struct nlattr *nla, tcf_idr_insert_many(actions); *attr_size = tcf_action_full_attrs_size(sz); - return i - 1; + err = i - 1; + goto err_mod; err: tcf_action_destroy(actions, bind); diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 9ecb91ebf094..340d5af86e87 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -3054,10 +3054,9 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb, rate_tlv, "police", ovr, TCA_ACT_BIND, a_o, init_res, rtnl_held, extack); - if (IS_ERR(act)) { - module_put(a_o->owner); + module_put(a_o->owner); + if (IS_ERR(act)) return PTR_ERR(act); - } act->type = exts->type = TCA_OLD_COMPAT; exts->actions[0] = act; -- 2.29.2 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH net v2 0/3] Action initalization fixes 2021-04-07 15:36 [PATCH net v2 0/3] Action initalization fixes Vlad Buslov ` (2 preceding siblings ...) 2021-04-07 15:36 ` [PATCH net v2 3/3] net: sched: fix err handler in tcf_action_init() Vlad Buslov @ 2021-04-08 22:02 ` Cong Wang 3 siblings, 0 replies; 11+ messages in thread From: Cong Wang @ 2021-04-08 22:02 UTC (permalink / raw) To: Vlad Buslov Cc: Linux Kernel Network Developers, Kumar Kartikeya Dwivedi, David Miller, Jamal Hadi Salim, Jiri Pirko, Jakub Kicinski, Toke Høiland-Jørgensen, Marcelo Ricardo Leitner, Davide Caratti On Wed, Apr 7, 2021 at 8:36 AM Vlad Buslov <vladbu@nvidia.com> wrote: > > This series fixes reference counting of action instances and modules in > several parts of action init code. The first patch reverts previous fix > that didn't properly account for rollback from a failure in the middle of > the loop in tcf_action_init() which is properly fixed by the following > patch. I still hate the init_res[] array, but I have no easy and better way to fix it either, so: Acked-by: Cong Wang <cong.wang@bytedance.com> For the long term, we probably want to split the action ->init() into two: ->init() and ->change(), like TC filters, which hopefully could ease the complexity of tcf_action_init_1(). Thanks. ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2021-04-08 22:02 UTC | newest] Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-04-07 15:36 [PATCH net v2 0/3] Action initalization fixes Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 1/3] Revert "net: sched: bump refcount for new action in ACT replace mode" Vlad Buslov 2021-04-07 15:36 ` [PATCH net v2 2/3] net: sched: fix action overwrite reference counting Vlad Buslov 2021-04-07 23:50 ` Cong Wang 2021-04-08 7:50 ` Vlad Buslov 2021-04-08 13:43 ` Jamal Hadi Salim 2021-04-08 21:52 ` Cong Wang 2021-04-08 11:59 ` Jamal Hadi Salim 2021-04-08 21:55 ` Cong Wang 2021-04-07 15:36 ` [PATCH net v2 3/3] net: sched: fix err handler in tcf_action_init() Vlad Buslov 2021-04-08 22:02 ` [PATCH net v2 0/3] Action initalization fixes Cong Wang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).