diff options
| author | Martin KaFai Lau <martin.lau@kernel.org> | 2023-07-27 17:51:49 -0700 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2023-07-27 18:35:36 -0700 |
| commit | e010522b3158eaf5c17dafe120761a737fb05876 (patch) | |
| tree | bcedcece22819c93bc0115d12edc630d93d8146c | |
| parent | 63e2da3b7f7f63f881aa508825b0c4241e9910e1 (diff) | |
| download | bpf-next-tcx_warn_fix.tar.gz | |
tcx: Fix splat during dev unregistertcx_warn_fix
During unregister_netdevice_many_notify(), the ordering of our
concerned function calls is like this
unregister_netdevice_many_notify
dev_shutdown
qdisc_put
clsact_destroy
tcx_uninstall
The syzbot reproducer triggered a case that the qdisc refcnt
is not zero during dev_shutdown(). tcx_uninstall() will then
WARN_ON_ONCE(tcx_entry(entry)->miniq_active) because
the miniq is still active and the entry should not be freed.
This patch is to avoid tcx_uninstall() doing tcx_entry_free() when
the miniq is still alive and let the clsact_destroy() do the free later.
tcx_uninstall() does bpf_mprog_dec(entry) when flushing out the prog/link.
clsact_destroy() will then notice the "!tcx_entry_is_active()" and then
does the tcx_entry_free().
Reported-by: syzbot+376a289e86a0fd02b9ba@syzkaller.appspotmail.com
Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support")
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
| -rw-r--r-- | kernel/bpf/tcx.c | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/kernel/bpf/tcx.c b/kernel/bpf/tcx.c index 69a272712b29f..853bec10df773 100644 --- a/kernel/bpf/tcx.c +++ b/kernel/bpf/tcx.c @@ -92,17 +92,34 @@ out: return ret; } +static struct bpf_mprog_entry * +bpf_mprog_empty_peer(struct bpf_mprog_entry *entry) +{ + struct bpf_mprog_entry *peer; + + peer = bpf_mprog_peer(entry); + memset(peer->fp_items, 0, sizeof(peer->fp_items)); + + return peer; +} + void tcx_uninstall(struct net_device *dev, bool ingress) { + struct bpf_mprog_entry *entry, *entry_new = NULL; struct bpf_tuple tuple = {}; - struct bpf_mprog_entry *entry; struct bpf_mprog_fp *fp; struct bpf_mprog_cp *cp; + bool active; entry = tcx_entry_fetch(dev, ingress); if (!entry) return; - tcx_entry_update(dev, NULL, ingress); + + active = tcx_entry(entry)->miniq_active; + if (active) + entry_new = bpf_mprog_empty_peer(entry); + + tcx_entry_update(dev, entry_new, ingress); tcx_entry_sync(); bpf_mprog_foreach_tuple(entry, fp, cp, tuple) { if (tuple.link) @@ -110,9 +127,10 @@ void tcx_uninstall(struct net_device *dev, bool ingress) else bpf_prog_put(tuple.prog); tcx_skeys_dec(ingress); + bpf_mprog_dec(entry); } - WARN_ON_ONCE(tcx_entry(entry)->miniq_active); - tcx_entry_free(entry); + if (!active) + tcx_entry_free(entry); } int tcx_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr) |