Commit e49d8c22 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

net_sched: defer tcf_idr_insert() in tcf_action_init_1() 



All TC actions call tcf_idr_insert() for new action at the end
of their ->init(), so we can actually move it to a central place
in tcf_action_init_1().

And once the action is inserted into the global IDR, other parallel
process could free it immediately as its refcnt is still 1, so we can
not fail after this, we need to move it after the goto action
validation to avoid handling the failure case after insertion.

This is found during code review, is not directly triggered by syzbot.
And this prepares for the next patch.

Cc: Vlad Buslov <vladbu@mellanox.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7241c5a6

include/net/act_api.h

+0 −2
Original line number Diff line number Diff line
@@ -166,8 +166,6 @@ int tcf_idr_create_from_flags(struct tc_action_net *tn, u32 index, 
			      struct nlattr *est, struct tc_action **a,

			      const struct tc_action_ops *ops, int bind,

			      u32 flags);

void tcf_idr_insert(struct tc_action_net *tn, struct tc_action *a);



void tcf_idr_cleanup(struct tc_action_net *tn, u32 index);

int tcf_idr_check_alloc(struct tc_action_net *tn, u32 *index,

			struct tc_action **a, int bind);

net/sched/act_api.c

+20 −18
Original line number Diff line number Diff line
@@ -467,17 +467,6 @@ int tcf_idr_create_from_flags(struct tc_action_net *tn, u32 index, 
}

EXPORT_SYMBOL(tcf_idr_create_from_flags);



void tcf_idr_insert(struct tc_action_net *tn, struct tc_action *a)

{

	struct tcf_idrinfo *idrinfo = tn->idrinfo;



	mutex_lock(&idrinfo->lock);

	/* Replace ERR_PTR(-EBUSY) allocated by tcf_idr_check_alloc */

	WARN_ON(!IS_ERR(idr_replace(&idrinfo->action_idr, a, a->tcfa_index)));

	mutex_unlock(&idrinfo->lock);

}

EXPORT_SYMBOL(tcf_idr_insert);



/* Cleanup idr index that was allocated but not initialized. */



void tcf_idr_cleanup(struct tc_action_net *tn, u32 index)
@@ -902,6 +891,16 @@ static const struct nla_policy tcf_action_policy[TCA_ACT_MAX + 1] = { 
	[TCA_ACT_HW_STATS]	= NLA_POLICY_BITFIELD32(TCA_ACT_HW_STATS_ANY),

};



static void tcf_idr_insert(struct tc_action *a)

{

	struct tcf_idrinfo *idrinfo = a->idrinfo;



	mutex_lock(&idrinfo->lock);

	/* Replace ERR_PTR(-EBUSY) allocated by tcf_idr_check_alloc */

	WARN_ON(!IS_ERR(idr_replace(&idrinfo->action_idr, a, a->tcfa_index)));

	mutex_unlock(&idrinfo->lock);

}



struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp,

				    struct nlattr *nla, struct nlattr *est,

				    char *name, int ovr, int bind,
@@ -989,6 +988,16 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, 
	if (err < 0)

		goto err_mod;



	if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN) &&

	    !rcu_access_pointer(a->goto_chain)) {

		tcf_action_destroy_1(a, bind);

		NL_SET_ERR_MSG(extack, "can't use goto chain with NULL chain");

		return ERR_PTR(-EINVAL);

	}



	if (err == ACT_P_CREATED)

		tcf_idr_insert(a);



	if (!name && tb[TCA_ACT_COOKIE])

		tcf_set_action_cookie(&a->act_cookie, cookie);
@@ -1002,13 +1011,6 @@ struct tc_action *tcf_action_init_1(struct net *net, struct tcf_proto *tp, 
	if (err != ACT_P_CREATED)

		module_put(a_o->owner);



	if (TC_ACT_EXT_CMP(a->tcfa_action, TC_ACT_GOTO_CHAIN) &&

	    !rcu_access_pointer(a->goto_chain)) {

		tcf_action_destroy_1(a, bind);

		NL_SET_ERR_MSG(extack, "can't use goto chain with NULL chain");

		return ERR_PTR(-EINVAL);

	}



	return a;



err_mod:

net/sched/act_bpf.c

+1 −3
Original line number Diff line number Diff line
@@ -365,9 +365,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, 
	if (goto_ch)

		tcf_chain_put_by_act(goto_ch);



	if (res == ACT_P_CREATED) {

		tcf_idr_insert(tn, *act);

	} else {

	if (res != ACT_P_CREATED) {

		/* make sure the program being replaced is no longer executing */

		synchronize_rcu();

		tcf_bpf_cfg_cleanup(&old);

net/sched/act_connmark.c

+0 −1
Original line number Diff line number Diff line
@@ -139,7 +139,6 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla, 
		ci->net = net;

		ci->zone = parm->zone;



		tcf_idr_insert(tn, *a);

		ret = ACT_P_CREATED;

	} else if (ret > 0) {

		ci = to_connmark(*a);

net/sched/act_csum.c

+0 −3
Original line number Diff line number Diff line
@@ -110,9 +110,6 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla, 
	if (params_new)

		kfree_rcu(params_new, rcu);



	if (ret == ACT_P_CREATED)

		tcf_idr_insert(tn, *a);



	return ret;

put_chain:

	if (goto_ch)

CRA Git | Maintained and supported by SUSTech CRA and CCSE