diff options
| author | Eric Dumazet <edumazet@google.com> | 2025-06-11 14:15:12 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-06-12 18:05:49 +0300 |
| commit | 85a3e0ede38450ea3053b8c45d28cf55208409b8 (patch) | |
| tree | 888a3280cf551a7d946eedd5bcb547b191e68cee /net | |
| parent | d35acc1be3480505b5931f17e4ea9b7617fea4d3 (diff) | |
| download | linux-85a3e0ede38450ea3053b8c45d28cf55208409b8.tar.xz | |
net_sched: red: fix a race in __red_change()
Gerrard Tai reported a race condition in RED, whenever SFQ perturb timer
fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
|
| [5]: lock root
| [6]: rehash
| [7]: qdisc_tree_reduce_backlog()
|
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
Fixes: 0c8d13ac9607 ("net: sched: red: delay destroying child qdisc on replace")
Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Suggested-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250611111515.1983366-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_red.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c index 1ba3e0bba54f..4696c893cf55 100644 --- a/net/sched/sch_red.c +++ b/net/sched/sch_red.c @@ -285,7 +285,7 @@ static int __red_change(struct Qdisc *sch, struct nlattr **tb, q->userbits = userbits; q->limit = ctl->limit; if (child) { - qdisc_tree_flush_backlog(q->qdisc); + qdisc_purge_queue(q->qdisc); old_child = q->qdisc; q->qdisc = child; } |