diff options
| author | Jiri Pirko <jiri@mellanox.com> | 2017-08-22 23:46:50 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-08-23 00:39:58 +0300 |
| commit | 30d65e8f96ad01d9f998039e9af9ce5545e5a4ee (patch) | |
| tree | 497408b42d7f0ee86b172ad3048944cb30997b14 /net/sched | |
| parent | 744a4cf63e528c29840f45811d6fb93fd129b87d (diff) | |
| download | linux-30d65e8f96ad01d9f998039e9af9ce5545e5a4ee.tar.xz | |
net: sched: don't do tcf_chain_flush from tcf_chain_destroy
tcf_chain_flush needs to be called with RTNL. However, on
free_tcf->
tcf_action_goto_chain_fini->
tcf_chain_put->
tcf_chain_destroy->
tcf_chain_flush
callpath, it is called without RTNL.
This issue was notified by following warning:
[ 155.599052] WARNING: suspicious RCU usage
[ 155.603165] 4.13.0-rc5jiri+ #54 Not tainted
[ 155.607456] -----------------------------
[ 155.611561] net/sched/cls_api.c:195 suspicious rcu_dereference_protected() usage!
Since on this callpath, the chain is guaranteed to be already empty
by check in tcf_chain_put, move the tcf_chain_flush call out and call it
only where it is needed - into tcf_block_put.
Fixes: db50514f9a9c ("net: sched: add termination action to allow goto chain")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_api.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 45cd34eee727..6c5ea84d2682 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -219,8 +219,6 @@ static void tcf_chain_destroy(struct tcf_chain *chain) if (!list_empty(&chain->list)) list_del_init(&chain->list); - tcf_chain_flush(chain); - /* There might still be a reference held when we got here from * tcf_block_put. Wait for the user to drop reference before free. */ @@ -296,8 +294,10 @@ void tcf_block_put(struct tcf_block *block) if (!block) return; - list_for_each_entry_safe(chain, tmp, &block->chain_list, list) + list_for_each_entry_safe(chain, tmp, &block->chain_list, list) { + tcf_chain_flush(chain); tcf_chain_destroy(chain); + } kfree(block); } EXPORT_SYMBOL(tcf_block_put); |