Commit 30d65e8f authored Aug 22, 2017 by Jiri Pirko Committed by David S. Miller Aug 22, 2017

net: sched: don't do tcf_chain_flush from tcf_chain_destroy



tcf_chain_flush needs to be called with RTNL. However, on
free_tcf->
 tcf_action_goto_chain_fini->
  tcf_chain_put->
   tcf_chain_destroy->
    tcf_chain_flush
callpath, it is called without RTNL.
This issue was notified by following warning:

[  155.599052] WARNING: suspicious RCU usage
[  155.603165] 4.13.0-rc5jiri+ #54 Not tainted
[  155.607456] -----------------------------
[  155.611561] net/sched/cls_api.c:195 suspicious rcu_dereference_protected() usage!

Since on this callpath, the chain is guaranteed to be already empty
by check in tcf_chain_put, move the tcf_chain_flush call out and call it
only where it is needed - into tcf_block_put.

Fixes: db50514f ("net: sched: add termination action to allow goto chain")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 744a4cf6

net/sched/cls_api.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -219,8 +219,6 @@ static void tcf_chain_destroy(struct tcf_chain *chain)
		if (!list_empty(&chain->list))
		list_del_init(&chain->list);

		tcf_chain_flush(chain);

		/* There might still be a reference held when we got here from
		* tcf_block_put. Wait for the user to drop reference before free.
		*/
		@@ -296,8 +294,10 @@ void tcf_block_put(struct tcf_block *block)
		if (!block)
		return;

		list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
		list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {
		tcf_chain_flush(chain);
		tcf_chain_destroy(chain);
		}
		kfree(block);
		}
		EXPORT_SYMBOL(tcf_block_put);

Admin message