tcx: Fix splat during dev unregister
During unregister_netdevice_many_notify(), the ordering of our
concerned function calls is like this
unregister_netdevice_many_notify
dev_shutdown
qdisc_put
clsact_destroy
tcx_uninstall
The syzbot reproducer triggered a case that the qdisc refcnt
is not zero during dev_shutdown(). tcx_uninstall() will then
WARN_ON_ONCE(tcx_entry(entry)->miniq_active) because
the miniq is still active and the entry should not be freed.
This patch is to avoid tcx_uninstall() doing tcx_entry_free() when
the miniq is still alive and let the clsact_destroy() do the free later.
tcx_uninstall() does bpf_mprog_dec(entry) when flushing out the prog/link.
clsact_destroy() will then notice the "!tcx_entry_is_active()" and then
does the tcx_entry_free().
Reported-by: syzbot+376a289e86a0fd02b9ba@syzkaller.appspotmail.com
Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support")
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
1 file changed
