Patch "net/sched: cls_api: Fix lockup on flushing explicitly created chain" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net/sched: cls_api: Fix lockup on flushing explicitly created chain

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-cls_api-fix-lockup-on-flushing-explicitly-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e5991706b44cfd222e5692385cf82f04693286b2
Author: Vlad Buslov <vladbu@xxxxxxxxxx>
Date:   Mon Jun 12 11:34:26 2023 +0200

    net/sched: cls_api: Fix lockup on flushing explicitly created chain
    
    [ Upstream commit c9a82bec02c339cdda99b37c5e62b3b71fc4209c ]
    
    Mingshuai Ren reports:
    
    When a new chain is added by using tc, one soft lockup alarm will be
     generated after delete the prio 0 filter of the chain. To reproduce
     the problem, perform the following steps:
    (1) tc qdisc add dev eth0 root handle 1: htb default 1
    (2) tc chain add dev eth0
    (3) tc filter del dev eth0 chain 0 parent 1: prio 0
    (4) tc filter add dev eth0 chain 0 parent 1:
    
    Fix the issue by accounting for additional reference to chains that are
    explicitly created by RTM_NEWCHAIN message as opposed to implicitly by
    RTM_NEWTFILTER message.
    
    Fixes: 726d061286ce ("net: sched: prevent insertion of new classifiers during chain flush")
    Reported-by: Mingshuai Ren <renmingshuai@xxxxxxxxxx>
    Closes: https://lore.kernel.org/lkml/87legswvi3.fsf@xxxxxxxxxx/T/
    Signed-off-by: Vlad Buslov <vladbu@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230612093426.2867183-1-vladbu@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d88a0946301c5..a5864ddfb8902 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -533,8 +533,8 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
 {
 	struct tcf_block *block = chain->block;
 	const struct tcf_proto_ops *tmplt_ops;
+	unsigned int refcnt, non_act_refcnt;
 	bool free_block = false;
-	unsigned int refcnt;
 	void *tmplt_priv;
 
 	mutex_lock(&block->lock);
@@ -554,13 +554,15 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
 	 * save these to temporary variables.
 	 */
 	refcnt = --chain->refcnt;
+	non_act_refcnt = refcnt - chain->action_refcnt;
 	tmplt_ops = chain->tmplt_ops;
 	tmplt_priv = chain->tmplt_priv;
 
-	/* The last dropped non-action reference will trigger notification. */
-	if (refcnt - chain->action_refcnt == 0 && !by_act) {
-		tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index,
-				       block, NULL, 0, 0, false);
+	if (non_act_refcnt == chain->explicitly_created && !by_act) {
+		if (non_act_refcnt == 0)
+			tc_chain_notify_delete(tmplt_ops, tmplt_priv,
+					       chain->index, block, NULL, 0, 0,
+					       false);
 		/* Last reference to chain, no need to lock. */
 		chain->flushing = false;
 	}



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux