tcx: Fix splat during dev unregister
During unregister_netdevice_many_notify(), the ordering of our
concerned function calls is like this
unregister_netdevice_many_notify
dev_shutdown
qdisc_put
clsact_destroy
tcx_uninstall
The syzbot reproducer triggered a case that the qdisc refcnt
is not zero during dev_shutdown(). tcx_uninstall() will then
WARN_ON_ONCE(tcx_entry(entry)->miniq_active) because
the miniq is still active and the entry should not be freed.
This patch is to avoid tcx_uninstall() doing tcx_entry_free() when
the miniq is still alive and let the clsact_destroy() do the free later.
tcx_uninstall() does bpf_mprog_dec(entry) when flushing out the prog/link.
clsact_destroy() will then notice the "!tcx_entry_is_active()" and then
does the tcx_entry_free().
Reported-by: syzbot+376a289e86a0fd02b9ba@syzkaller.appspotmail.com
Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support")
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
diff --git a/kernel/bpf/tcx.c b/kernel/bpf/tcx.c
index 69a2727..853bec1 100644
--- a/kernel/bpf/tcx.c
+++ b/kernel/bpf/tcx.c
@@ -92,17 +92,34 @@
return ret;
}
+static struct bpf_mprog_entry *
+bpf_mprog_empty_peer(struct bpf_mprog_entry *entry)
+{
+ struct bpf_mprog_entry *peer;
+
+ peer = bpf_mprog_peer(entry);
+ memset(peer->fp_items, 0, sizeof(peer->fp_items));
+
+ return peer;
+}
+
void tcx_uninstall(struct net_device *dev, bool ingress)
{
+ struct bpf_mprog_entry *entry, *entry_new = NULL;
struct bpf_tuple tuple = {};
- struct bpf_mprog_entry *entry;
struct bpf_mprog_fp *fp;
struct bpf_mprog_cp *cp;
+ bool active;
entry = tcx_entry_fetch(dev, ingress);
if (!entry)
return;
- tcx_entry_update(dev, NULL, ingress);
+
+ active = tcx_entry(entry)->miniq_active;
+ if (active)
+ entry_new = bpf_mprog_empty_peer(entry);
+
+ tcx_entry_update(dev, entry_new, ingress);
tcx_entry_sync();
bpf_mprog_foreach_tuple(entry, fp, cp, tuple) {
if (tuple.link)
@@ -110,9 +127,10 @@
else
bpf_prog_put(tuple.prog);
tcx_skeys_dec(ingress);
+ bpf_mprog_dec(entry);
}
- WARN_ON_ONCE(tcx_entry(entry)->miniq_active);
- tcx_entry_free(entry);
+ if (!active)
+ tcx_entry_free(entry);
}
int tcx_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
