act_mirred: fix a race condition on mirred_list (6bd00b85) · Commits · 戴 / test

After commit ("net: sched: make cls_u32 lockless") we began to release tc actions in a RCU callback. However, mirred action relies on RTNL lock to protect the global mirred_list, therefore we could have a race condition between RCU callback and netdevice event, which caused a list corruption as reported by Vinson. Instead of relying on RTNL lock, introduce a spinlock to protect this list. Note, in non-bind case, it is still called with RTNL lock, therefore should disable BH too. Reported-by:

Vinson Lee <vlee@twopensource.com> Cc: John Fastabend <john.fastabend@gmail.com> Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by:

Cong Wang <cwang@twopensource.com> Signed-off-by:

Cong Wang <xiyou.wangcong@gmail.com> Acked-by:

Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/sched/act_mirred.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -31,13 +31,17 @@

		#define MIRRED_TAB_MASK 7
		static LIST_HEAD(mirred_list);
		static DEFINE_SPINLOCK(mirred_list_lock);

		static void tcf_mirred_release(struct tc_action *a, int bind)
		{
		struct tcf_mirred *m = to_mirred(a);
		struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1);

		/* We could be called either in a RCU callback or with RTNL lock held. */
		spin_lock_bh(&mirred_list_lock);
		list_del(&m->tcfm_list);
		spin_unlock_bh(&mirred_list_lock);
		if (dev)
		dev_put(dev);
		}
		@@ -123,7 +127,9 @@ static int tcf_mirred_init(struct net net, struct nlattr nla,
		}

		if (ret == ACT_P_CREATED) {
		spin_lock_bh(&mirred_list_lock);
		list_add(&m->tcfm_list, &mirred_list);
		spin_unlock_bh(&mirred_list_lock);
		tcf_hash_insert(a);
		}

		@@ -221,7 +227,8 @@ static int mirred_device_event(struct notifier_block *unused,
		struct tcf_mirred *m;

		ASSERT_RTNL();
		if (event == NETDEV_UNREGISTER)
		if (event == NETDEV_UNREGISTER) {
		spin_lock_bh(&mirred_list_lock);
		list_for_each_entry(m, &mirred_list, tcfm_list) {
		if (rcu_access_pointer(m->tcfm_dev) == dev) {
		dev_put(dev);
		@@ -231,6 +238,8 @@ static int mirred_device_event(struct notifier_block *unused,
		RCU_INIT_POINTER(m->tcfm_dev, NULL);
		}
		}
		spin_unlock_bh(&mirred_list_lock);
		}

		return NOTIFY_DONE;
		}

Admin message