1. 04 Sep, 2018 2 commits
    • Vlad Buslov's avatar
      net: sched: action_ife: take reference to meta module · 84cb8eb2
      Vlad Buslov authored
      Recent refactoring of add_metainfo() caused use_all_metadata() to add
      metainfo to ife action metalist without taking reference to module. This
      causes warning in module_put called from ife action cleanup function.
      
      Implement add_metainfo_and_get_ops() function that returns with reference
      to module taken if metainfo was added successfully, and call it from
      use_all_metadata(), instead of calling __add_metainfo() directly.
      
      Example warning:
      
      [  646.344393] WARNING: CPU: 1 PID: 2278 at kernel/module.c:1139 module_put+0x1cb/0x230
      [  646.352437] Modules linked in: act_meta_skbtcindex act_meta_mark act_meta_skbprio act_ife ife veth nfsv3 nfs fscache xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c tun ebtable_filter ebtables ip6table_filter ip6_tables bridge stp llc mlx5_ib ib_uverbs ib_core intel_rapl sb_edac x86_pkg_temp_thermal mlx5_core coretemp kvm_intel kvm nfsd igb irqbypass crct10dif_pclmul devlink crc32_pclmul mei_me joydev ses crc32c_intel enclosure auth_rpcgss i2c_algo_bit ioatdma ptp mei pps_core ghash_clmulni_intel iTCO_wdt iTCO_vendor_support pcspkr dca ipmi_ssif lpc_ich target_core_mod i2c_i801 ipmi_si ipmi_devintf pcc_cpufreq wmi ipmi_msghandler nfs_acl lockd acpi_pad acpi_power_meter grace sunrpc mpt3sas raid_class scsi_transport_sas
      [  646.425631] CPU: 1 PID: 2278 Comm: tc Not tainted 4.19.0-rc1+ #799
      [  646.432187] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017
      [  646.440595] RIP: 0010:module_put+0x1cb/0x230
      [  646.445238] Code: f3 66 94 02 e8 26 ff fa ff 85 c0 74 11 0f b6 1d 51 30 94 02 80 fb 01 77 60 83 e3 01 74 13 65 ff 0d 3a 83 db 73 e9 2b ff ff ff <0f> 0b e9 00 ff ff ff e8 59 01 fb ff 85 c0 75 e4 48 c7 c2 20 62 6b
      [  646.464997] RSP: 0018:ffff880354d37068 EFLAGS: 00010286
      [  646.470599] RAX: 0000000000000000 RBX: ffffffffc0a52518 RCX: ffffffff8c2668db
      [  646.478118] RDX: 0000000000000003 RSI: dffffc0000000000 RDI: ffffffffc0a52518
      [  646.485641] RBP: ffffffffc0a52180 R08: fffffbfff814a4a4 R09: fffffbfff814a4a3
      [  646.493164] R10: ffffffffc0a5251b R11: fffffbfff814a4a4 R12: 1ffff1006a9a6e0d
      [  646.500687] R13: 00000000ffffffff R14: ffff880362bab890 R15: dead000000000100
      [  646.508213] FS:  00007f4164c99800(0000) GS:ffff88036fe40000(0000) knlGS:0000000000000000
      [  646.516961] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  646.523080] CR2: 00007f41638b8420 CR3: 0000000351df0004 CR4: 00000000001606e0
      [  646.530595] Call Trace:
      [  646.533408]  ? find_symbol_in_section+0x260/0x260
      [  646.538509]  tcf_ife_cleanup+0x11b/0x200 [act_ife]
      [  646.543695]  tcf_action_cleanup+0x29/0xa0
      [  646.548078]  __tcf_action_put+0x5a/0xb0
      [  646.552289]  ? nla_put+0x65/0xe0
      [  646.555889]  __tcf_idr_release+0x48/0x60
      [  646.560187]  tcf_generic_walker+0x448/0x6b0
      [  646.564764]  ? tcf_action_dump_1+0x450/0x450
      [  646.569411]  ? __lock_is_held+0x84/0x110
      [  646.573720]  ? tcf_ife_walker+0x10c/0x20f [act_ife]
      [  646.578982]  tca_action_gd+0x972/0xc40
      [  646.583129]  ? tca_get_fill.constprop.17+0x250/0x250
      [  646.588471]  ? mark_lock+0xcf/0x980
      [  646.592324]  ? check_chain_key+0x140/0x1f0
      [  646.596832]  ? debug_show_all_locks+0x240/0x240
      [  646.601839]  ? memset+0x1f/0x40
      [  646.605350]  ? nla_parse+0xca/0x1a0
      [  646.609217]  tc_ctl_action+0x215/0x230
      [  646.613339]  ? tcf_action_add+0x220/0x220
      [  646.617748]  rtnetlink_rcv_msg+0x56a/0x6d0
      [  646.622227]  ? rtnl_fdb_del+0x3f0/0x3f0
      [  646.626466]  netlink_rcv_skb+0x18d/0x200
      [  646.630752]  ? rtnl_fdb_del+0x3f0/0x3f0
      [  646.634959]  ? netlink_ack+0x500/0x500
      [  646.639106]  netlink_unicast+0x2d0/0x370
      [  646.643409]  ? netlink_attachskb+0x340/0x340
      [  646.648050]  ? _copy_from_iter_full+0xe9/0x3e0
      [  646.652870]  ? import_iovec+0x11e/0x1c0
      [  646.657083]  netlink_sendmsg+0x3b9/0x6a0
      [  646.661388]  ? netlink_unicast+0x370/0x370
      [  646.665877]  ? netlink_unicast+0x370/0x370
      [  646.670351]  sock_sendmsg+0x6b/0x80
      [  646.674212]  ___sys_sendmsg+0x4a1/0x520
      [  646.678443]  ? copy_msghdr_from_user+0x210/0x210
      [  646.683463]  ? lock_downgrade+0x320/0x320
      [  646.687849]  ? debug_show_all_locks+0x240/0x240
      [  646.692760]  ? do_raw_spin_unlock+0xa2/0x130
      [  646.697418]  ? _raw_spin_unlock+0x24/0x30
      [  646.701798]  ? __handle_mm_fault+0x1819/0x1c10
      [  646.706619]  ? __pmd_alloc+0x320/0x320
      [  646.710738]  ? debug_show_all_locks+0x240/0x240
      [  646.715649]  ? restore_nameidata+0x7b/0xa0
      [  646.720117]  ? check_chain_key+0x140/0x1f0
      [  646.724590]  ? check_chain_key+0x140/0x1f0
      [  646.729070]  ? __fget_light+0xbc/0xd0
      [  646.733121]  ? __sys_sendmsg+0xd7/0x150
      [  646.737329]  __sys_sendmsg+0xd7/0x150
      [  646.741359]  ? __ia32_sys_shutdown+0x30/0x30
      [  646.746003]  ? up_read+0x53/0x90
      [  646.749601]  ? __do_page_fault+0x484/0x780
      [  646.754105]  ? do_syscall_64+0x1e/0x2c0
      [  646.758320]  do_syscall_64+0x72/0x2c0
      [  646.762353]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  646.767776] RIP: 0033:0x7f4163872150
      [  646.771713] Code: 8b 15 3c 7d 2b 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb cd 66 0f 1f 44 00 00 83 3d b9 d5 2b 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 be cd 00 00 48 89 04 24
      [  646.791474] RSP: 002b:00007ffdef7d6b58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
      [  646.799721] RAX: ffffffffffffffda RBX: 0000000000000024 RCX: 00007f4163872150
      [  646.807240] RDX: 0000000000000000 RSI: 00007ffdef7d6bd0 RDI: 0000000000000003
      [  646.814760] RBP: 000000005b8b9482 R08: 0000000000000001 R09: 0000000000000000
      [  646.822286] R10: 00000000000005e7 R11: 0000000000000246 R12: 00007ffdef7dad20
      [  646.829807] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000679bc0
      [  646.837360] irq event stamp: 6083
      [  646.841043] hardirqs last  enabled at (6081): [<ffffffff8c220a7d>] __call_rcu+0x17d/0x500
      [  646.849882] hardirqs last disabled at (6083): [<ffffffff8c004f06>] trace_hardirqs_off_thunk+0x1a/0x1c
      [  646.859775] softirqs last  enabled at (5968): [<ffffffff8d4004a1>] __do_softirq+0x4a1/0x6ee
      [  646.868784] softirqs last disabled at (6082): [<ffffffffc0a78759>] tcf_ife_cleanup+0x39/0x200 [act_ife]
      [  646.878845] ---[ end trace b1b8c12ffe51e657 ]---
      
      Fixes: 5ffe57da ("act_ife: fix a potential deadlock")
      Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84cb8eb2
    • Cong Wang's avatar
      act_ife: fix a potential use-after-free · 6d784f16
      Cong Wang authored
      Immediately after module_put(), user could delete this
      module, so e->ops could be already freed before we call
      e->ops->release().
      
      Fix this by moving module_put() after ops->release().
      
      Fixes: ef6980b6 ("introduce IFE action")
      Cc: Jamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      6d784f16
  2. 01 Sep, 2018 1 commit
  3. 21 Aug, 2018 4 commits
  4. 16 Aug, 2018 1 commit
  5. 13 Aug, 2018 1 commit
    • Vlad Buslov's avatar
      net: sched: act_ife: disable bh when taking ife_mod_lock · 42c625a4
      Vlad Buslov authored
      Lockdep reports deadlock for following locking scenario in ife action:
      
      Task one:
      1) Executes ife action update.
      2) Takes tcfa_lock.
      3) Waits on ife_mod_lock which is already taken by task two.
      
      Task two:
      
      1) Executes any path that obtains ife_mod_lock without disabling bh (any
      path that takes ife_mod_lock while holding tcfa_lock has bh disabled) like
      loading a meta module, or creating new action.
      2) Takes ife_mod_lock.
      3) Task is preempted by rate estimator timer.
      4) Timer callback waits on tcfa_lock which is taken by task one.
      
      In described case tasks deadlock because they take same two locks in
      different order. To prevent potential deadlock reported by lockdep, always
      disable bh when obtaining ife_mod_lock.
      
      Lockdep warning:
      
      [  508.101192] =====================================================
      [  508.107708] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
      [  508.114728] 4.18.0-rc8+ #646 Not tainted
      [  508.119050] -----------------------------------------------------
      [  508.125559] tc/5460 [HC0[0]:SC0[2]:HE1:SE0] is trying to acquire:
      [  508.132025] 000000005a938c68 (ife_mod_lock){++++}, at: find_ife_oplist+0x1e/0xc0 [act_ife]
      [  508.140996]
                     and this task is already holding:
      [  508.147548] 00000000d46f6c56 (&(&p->tcfa_lock)->rlock){+.-.}, at: tcf_ife_init+0x6ae/0xf40 [act_ife]
      [  508.157371] which would create a new lock dependency:
      [  508.162828]  (&(&p->tcfa_lock)->rlock){+.-.} -> (ife_mod_lock){++++}
      [  508.169572]
                     but this new dependency connects a SOFTIRQ-irq-safe lock:
      [  508.178197]  (&(&p->tcfa_lock)->rlock){+.-.}
      [  508.178201]
                     ... which became SOFTIRQ-irq-safe at:
      [  508.189771]   _raw_spin_lock+0x2c/0x40
      [  508.193906]   est_fetch_counters+0x41/0xb0
      [  508.198391]   est_timer+0x83/0x3c0
      [  508.202180]   call_timer_fn+0x16a/0x5d0
      [  508.206400]   run_timer_softirq+0x399/0x920
      [  508.210967]   __do_softirq+0x157/0x97d
      [  508.215102]   irq_exit+0x152/0x1c0
      [  508.218888]   smp_apic_timer_interrupt+0xc0/0x4e0
      [  508.223976]   apic_timer_interrupt+0xf/0x20
      [  508.228540]   cpuidle_enter_state+0xf8/0x5d0
      [  508.233198]   do_idle+0x28a/0x350
      [  508.236881]   cpu_startup_entry+0xc7/0xe0
      [  508.241296]   start_secondary+0x2e8/0x3f0
      [  508.245678]   secondary_startup_64+0xa5/0xb0
      [  508.250347]
                     to a SOFTIRQ-irq-unsafe lock:  (ife_mod_lock){++++}
      [  508.256531]
                     ... which became SOFTIRQ-irq-unsafe at:
      [  508.267279] ...
      [  508.267283]   _raw_write_lock+0x2c/0x40
      [  508.273653]   register_ife_op+0x118/0x2c0 [act_ife]
      [  508.278926]   do_one_initcall+0xf7/0x4d9
      [  508.283214]   do_init_module+0x18b/0x44e
      [  508.287521]   load_module+0x4167/0x5730
      [  508.291739]   __do_sys_finit_module+0x16d/0x1a0
      [  508.296654]   do_syscall_64+0x7a/0x3f0
      [  508.300788]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  508.306302]
                     other info that might help us debug this:
      
      [  508.315286]  Possible interrupt unsafe locking scenario:
      
      [  508.322771]        CPU0                    CPU1
      [  508.327681]        ----                    ----
      [  508.332604]   lock(ife_mod_lock);
      [  508.336300]                                local_irq_disable();
      [  508.342608]                                lock(&(&p->tcfa_lock)->rlock);
      [  508.349793]                                lock(ife_mod_lock);
      [  508.355990]   <Interrupt>
      [  508.358974]     lock(&(&p->tcfa_lock)->rlock);
      [  508.363803]
                      *** DEADLOCK ***
      
      [  508.370715] 2 locks held by tc/5460:
      [  508.374680]  #0: 00000000e27e4fa4 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x583/0x7b0
      [  508.383366]  #1: 00000000d46f6c56 (&(&p->tcfa_lock)->rlock){+.-.}, at: tcf_ife_init+0x6ae/0xf40 [act_ife]
      [  508.393648]
                     the dependencies between SOFTIRQ-irq-safe lock and the holding lock:
      [  508.403505] -> (&(&p->tcfa_lock)->rlock){+.-.} ops: 1001553 {
      [  508.409646]    HARDIRQ-ON-W at:
      [  508.413136]                     _raw_spin_lock_bh+0x34/0x40
      [  508.419059]                     gnet_stats_start_copy_compat+0xa2/0x230
      [  508.426021]                     gnet_stats_start_copy+0x16/0x20
      [  508.432333]                     tcf_action_copy_stats+0x95/0x1d0
      [  508.438735]                     tcf_action_dump_1+0xb0/0x4e0
      [  508.444795]                     tcf_action_dump+0xca/0x200
      [  508.450673]                     tcf_exts_dump+0xd9/0x320
      [  508.456392]                     fl_dump+0x1b7/0x4a0 [cls_flower]
      [  508.462798]                     tcf_fill_node+0x380/0x530
      [  508.468601]                     tfilter_notify+0xdf/0x1c0
      [  508.474404]                     tc_new_tfilter+0x84a/0xc90
      [  508.480270]                     rtnetlink_rcv_msg+0x5bd/0x7b0
      [  508.486419]                     netlink_rcv_skb+0x184/0x220
      [  508.492394]                     netlink_unicast+0x31b/0x460
      [  508.507411]                     netlink_sendmsg+0x3fb/0x840
      [  508.513390]                     sock_sendmsg+0x7b/0xd0
      [  508.518907]                     ___sys_sendmsg+0x4c6/0x610
      [  508.524797]                     __sys_sendmsg+0xd7/0x150
      [  508.530510]                     do_syscall_64+0x7a/0x3f0
      [  508.536201]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  508.543301]    IN-SOFTIRQ-W at:
      [  508.546834]                     _raw_spin_lock+0x2c/0x40
      [  508.552522]                     est_fetch_counters+0x41/0xb0
      [  508.558571]                     est_timer+0x83/0x3c0
      [  508.563912]                     call_timer_fn+0x16a/0x5d0
      [  508.569699]                     run_timer_softirq+0x399/0x920
      [  508.575840]                     __do_softirq+0x157/0x97d
      [  508.581538]                     irq_exit+0x152/0x1c0
      [  508.586882]                     smp_apic_timer_interrupt+0xc0/0x4e0
      [  508.593533]                     apic_timer_interrupt+0xf/0x20
      [  508.599686]                     cpuidle_enter_state+0xf8/0x5d0
      [  508.605895]                     do_idle+0x28a/0x350
      [  508.611147]                     cpu_startup_entry+0xc7/0xe0
      [  508.617097]                     start_secondary+0x2e8/0x3f0
      [  508.623029]                     secondary_startup_64+0xa5/0xb0
      [  508.629245]    INITIAL USE at:
      [  508.632686]                    _raw_spin_lock_bh+0x34/0x40
      [  508.638557]                    gnet_stats_start_copy_compat+0xa2/0x230
      [  508.645491]                    gnet_stats_start_copy+0x16/0x20
      [  508.651719]                    tcf_action_copy_stats+0x95/0x1d0
      [  508.657992]                    tcf_action_dump_1+0xb0/0x4e0
      [  508.663937]                    tcf_action_dump+0xca/0x200
      [  508.669716]                    tcf_exts_dump+0xd9/0x320
      [  508.675337]                    fl_dump+0x1b7/0x4a0 [cls_flower]
      [  508.681650]                    tcf_fill_node+0x380/0x530
      [  508.687366]                    tfilter_notify+0xdf/0x1c0
      [  508.693031]                    tc_new_tfilter+0x84a/0xc90
      [  508.698820]                    rtnetlink_rcv_msg+0x5bd/0x7b0
      [  508.704869]                    netlink_rcv_skb+0x184/0x220
      [  508.710758]                    netlink_unicast+0x31b/0x460
      [  508.716627]                    netlink_sendmsg+0x3fb/0x840
      [  508.722510]                    sock_sendmsg+0x7b/0xd0
      [  508.727931]                    ___sys_sendmsg+0x4c6/0x610
      [  508.733729]                    __sys_sendmsg+0xd7/0x150
      [  508.739346]                    do_syscall_64	+0x7a/0x3f0
      [  508.744943]                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  508.751930]  }
      [  508.753964]  ... key      at: [<ffffffff916b3e20>] __key.61145+0x0/0x40
      [  508.760946]  ... acquired at:
      [  508.764294]    _raw_read_lock+0x2f/0x40
      [  508.768513]    find_ife_oplist+0x1e/0xc0 [act_ife]
      [  508.773692]    tcf_ife_init+0x82f/0xf40 [act_ife]
      [  508.778785]    tcf_action_init_1+0x510/0x750
      [  508.783468]    tcf_action_init+0x1e8/0x340
      [  508.787938]    tcf_action_add+0xc5/0x240
      [  508.792241]    tc_ctl_action+0x203/0x2a0
      [  508.796550]    rtnetlink_rcv_msg+0x5bd/0x7b0
      [  508.801200]    netlink_rcv_skb+0x184/0x220
      [  508.805674]    netlink_unicast+0x31b/0x460
      [  508.810129]    netlink_sendmsg+0x3fb/0x840
      [  508.814611]    sock_sendmsg+0x7b/0xd0
      [  508.818665]    ___sys_sendmsg+0x4c6/0x610
      [  508.823029]    __sys_sendmsg+0xd7/0x150
      [  508.827246]    do_syscall_64+0x7a/0x3f0
      [  508.831483]    entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
                     the dependencies between the lock to be acquired
      [  508.838945]  and SOFTIRQ-irq-unsafe lock:
      [  508.851177] -> (ife_mod_lock){++++} ops: 95 {
      [  508.855920]    HARDIRQ-ON-W at:
      [  508.859478]                     _raw_write_lock+0x2c/0x40
      [  508.865264]                     register_ife_op+0x118/0x2c0 [act_ife]
      [  508.872071]                     do_one_initcall+0xf7/0x4d9
      [  508.877947]                     do_init_module+0x18b/0x44e
      [  508.883819]                     load_module+0x4167/0x5730
      [  508.889595]                     __do_sys_finit_module+0x16d/0x1a0
      [  508.896043]                     do_syscall_64+0x7a/0x3f0
      [  508.901734]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  508.908827]    HARDIRQ-ON-R at:
      [  508.912359]                     _raw_read_lock+0x2f/0x40
      [  508.918043]                     find_ife_oplist+0x1e/0xc0 [act_ife]
      [  508.924692]                     tcf_ife_init+0x82f/0xf40 [act_ife]
      [  508.931252]                     tcf_action_init_1+0x510/0x750
      [  508.937393]                     tcf_action_init+0x1e8/0x340
      [  508.943366]                     tcf_action_add+0xc5/0x240
      [  508.949130]                     tc_ctl_action+0x203/0x2a0
      [  508.954922]                     rtnetlink_rcv_msg+0x5bd/0x7b0
      [  508.961024]                     netlink_rcv_skb+0x184/0x220
      [  508.966970]                     netlink_unicast+0x31b/0x460
      [  508.972915]                     netlink_sendmsg+0x3fb/0x840
      [  508.978859]                     sock_sendmsg+0x7b/0xd0
      [  508.984400]                     ___sys_sendmsg+0x4c6/0x610
      [  508.990264]                     __sys_sendmsg+0xd7/0x150
      [  508.995952]                     do_syscall_64+0x7a/0x3f0
      [  509.001643]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  509.008722]    SOFTIRQ-ON-W at:\
      [  509.012242]                     _raw_write_lock+0x2c/0x40
      [  509.018013]                     register_ife_op+0x118/0x2c0 [act_ife]
      [  509.024841]                     do_one_initcall+0xf7/0x4d9
      [  509.030720]                     do_init_module+0x18b/0x44e
      [  509.036604]                     load_module+0x4167/0x5730
      [  509.042397]                     __do_sys_finit_module+0x16d/0x1a0
      [  509.048865]                     do_syscall_64+0x7a/0x3f0
      [  509.054551]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  509.061636]    SOFTIRQ-ON-R at:
      [  509.065145]                     _raw_read_lock+0x2f/0x40
      [  509.070854]                     find_ife_oplist+0x1e/0xc0 [act_ife]
      [  509.077515]                     tcf_ife_init+0x82f/0xf40 [act_ife]
      [  509.084051]                     tcf_action_init_1+0x510/0x750
      [  509.090172]                     tcf_action_init+0x1e8/0x340
      [  509.096124]                     tcf_action_add+0xc5/0x240
      [  509.101891]                     tc_ctl_action+0x203/0x2a0
      [  509.107671]                     rtnetlink_rcv_msg+0x5bd/0x7b0
      [  509.113811]                     netlink_rcv_skb+0x184/0x220
      [  509.119768]                     netlink_unicast+0x31b/0x460
      [  509.125716]                     netlink_sendmsg+0x3fb/0x840
      [  509.131668]                     sock_sendmsg+0x7b/0xd0
      [  509.137167]                     ___sys_sendmsg+0x4c6/0x610
      [  509.143010]                     __sys_sendmsg+0xd7/0x150
      [  509.148718]                     do_syscall_64+0x7a/0x3f0
      [  509.154443]                     entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  509.161533]    INITIAL USE at:
      [  509.164956]                    _raw_read_lock+0x2f/0x40
      [  509.170574]                    find_ife_oplist+0x1e/0xc0 [act_ife]
      [  509.177134]                    tcf_ife_init+0x82f/0xf40 [act_ife]
      [  509.183619]                    tcf_action_init_1+0x510/0x750
      [  509.189674]                    tcf_action_init+0x1e8/0x340
      [  509.195534]                    tcf_action_add+0xc5/0x240
      [  509.201229]                    tc_ctl_action+0x203/0x2a0
      [  509.206920]                    rtnetlink_rcv_msg+0x5bd/0x7b0
      [  509.212936]                    netlink_rcv_skb+0x184/0x220
      [  509.218818]                    netlink_unicast+0x31b/0x460
      [  509.224699]                    netlink_sendmsg+0x3fb/0x840
      [  509.230581]                    sock_sendmsg+0x7b/0xd0
      [  509.235984]                    ___sys_sendmsg+0x4c6/0x610
      [  509.241791]                    __sys_sendmsg+0xd7/0x150
      [  509.247425]                    do_syscall_64+0x7a/0x3f0
      [  509.253007]                    entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  509.259975]  }
      [  509.261998]  ... key      at: [<ffffffffc1554258>] ife_mod_lock+0x18/0xffffffffffff8dc0 [act_ife]
      [  509.271569]  ... acquired at:
      [  509.274912]    _raw_read_lock+0x2f/0x40
      [  509.279134]    find_ife_oplist+0x1e/0xc0 [act_ife]
      [  509.284324]    tcf_ife_init+0x82f/0xf40 [act_ife]
      [  509.289425]    tcf_action_init_1+0x510/0x750
      [  509.294068]    tcf_action_init+0x1e8/0x340
      [  509.298553]    tcf_action_add+0xc5/0x240
      [  509.302854]    tc_ctl_action+0x203/0x2a0
      [  509.307153]    rtnetlink_rcv_msg+0x5bd/0x7b0
      [  509.311805]    netlink_rcv_skb+0x184/0x220
      [  509.316282]    netlink_unicast+0x31b/0x460
      [  509.320769]    netlink_sendmsg+0x3fb/0x840
      [  509.325248]    sock_sendmsg+0x7b/0xd0
      [  509.329290]    ___sys_sendmsg+0x4c6/0x610
      [  509.333687]    __sys_sendmsg+0xd7/0x150
      [  509.337902]    do_syscall_64+0x7a/0x3f0
      [  509.342116]    entry_SYSCALL_64_after_hwframe+0x49/0xbe
      [  509.349601]
                     stack backtrace:
      [  509.354663] CPU: 6 PID: 5460 Comm: tc Not tainted 4.18.0-rc8+ #646
      [  509.361216] Hardware name: Supermicro SYS-2028TP-DECR/X10DRT-P, BIOS 2.0b 03/30/2017
      
      Fixes: ef6980b6 ("introduce IFE action")
      Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      42c625a4
  6. 11 Aug, 2018 1 commit
    • Vlad Buslov's avatar
      net: sched: act_ife: remove dependency on rtnl lock · 54d0d423
      Vlad Buslov authored
      Use tcf spinlock and rcu to protect params pointer from concurrent
      modification during dump and init. Use rcu swap operation to reassign
      params pointer under protection of tcf lock. (old params value is not used
      by init, so there is no need of standalone rcu dereference step)
      
      Ife action has meta-actions that are compiled as standalone modules. Rtnl
      mutex must be released while loading a kernel module. In order to support
      execution without rtnl mutex, propagate 'rtnl_held' argument to meta action
      loading functions. When requesting meta action module, conditionally
      release rtnl lock depending on 'rtnl_held' argument.
      Signed-off-by: default avatarVlad Buslov <vladbu@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      54d0d423
  7. 30 Jul, 2018 1 commit
    • Paolo Abeni's avatar
      tc/act: remove unneeded RCU lock in action callback · 7fd4b288
      Paolo Abeni authored
      Each lockless action currently does its own RCU locking in ->act().
      This allows using plain RCU accessor, even if the context
      is really RCU BH.
      
      This change drops the per action RCU lock, replace the accessors
      with the _bh variant, cleans up a bit the surrounding code and
      documents the RCU status in the relevant header.
      No functional nor performance change is intended.
      
      The goal of this patch is clarifying that the RCU critical section
      used by the tc actions extends up to the classifier's caller.
      
      v1 -> v2:
       - preserve rcu lock in act_bpf: it's needed by eBPF helpers,
         as pointed out by Daniel
      
      v3 -> v4:
       - fixed some typos in the commit message (JiriP)
      Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Acked-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7fd4b288
  8. 12 Jul, 2018 1 commit
  9. 08 Jul, 2018 5 commits
  10. 20 Jun, 2018 2 commits
    • Davide Caratti's avatar
      net/sched: act_ife: preserve the action control in case of error · cbf56c29
      Davide Caratti authored
      in the following script
      
       # tc actions add action ife encode allow prio pass index 42
       # tc actions replace action ife encode allow tcindex drop index 42
      
      the action control should remain equal to 'pass', if the kernel failed
      to replace the TC action. Pospone the assignment of the action control,
      to ensure it is not overwritten in the error path of tcf_ife_init().
      
      Fixes: ef6980b6 ("introduce IFE action")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      cbf56c29
    • Davide Caratti's avatar
      net/sched: act_ife: fix recursive lock and idr leak · 0a889b94
      Davide Caratti authored
      a recursive lock warning [1] can be observed with the following script,
      
       # $TC actions add action ife encode allow prio pass index 42
       IFE type 0xED3E
       # $TC actions replace action ife encode allow tcindex pass index 42
      
      in case the kernel was unable to run the last command (e.g. because of
      the impossibility to load 'act_meta_skbtcindex'). For a similar reason,
      the kernel can leak idr in the error path of tcf_ife_init(), because
      tcf_idr_release() is not called after successful idr reservation:
      
       # $TC actions add action ife encode allow tcindex index 47
       IFE type 0xED3E
       RTNETLINK answers: No such file or directory
       We have an error talking to the kernel
       # $TC actions add action ife encode allow tcindex index 47
       IFE type 0xED3E
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
       # $TC actions add action ife encode use mark 7 type 0xfefe pass index 47
       IFE type 0xFEFE
       RTNETLINK answers: No space left on device
       We have an error talking to the kernel
      
      Since tcfa_lock is already taken when the action is being edited, a call
      to tcf_idr_release() wrongly makes tcf_idr_cleanup() take the same lock
      again. On the other hand, tcf_idr_release() needs to be called in the
      error path of tcf_ife_init(), to undo the last tcf_idr_create() invocation.
      Fix both problems in tcf_ife_init().
      Since the cleanup() routine can now be called when ife->params is NULL,
      also add a NULL pointer check to avoid calling kfree_rcu(NULL, rcu).
      
       [1]
       ============================================
       WARNING: possible recursive locking detected
       4.17.0-rc4.kasan+ #417 Tainted: G            E
       --------------------------------------------
       tc/3932 is trying to acquire lock:
       000000005097c9a6 (&(&p->tcfa_lock)->rlock){+...}, at: tcf_ife_cleanup+0x19/0x80 [act_ife]
      
       but task is already holding lock:
       000000005097c9a6 (&(&p->tcfa_lock)->rlock){+...}, at: tcf_ife_init+0xf6d/0x13c0 [act_ife]
      
       other info that might help us debug this:
        Possible unsafe locking scenario:
      
              CPU0
              ----
         lock(&(&p->tcfa_lock)->rlock);
         lock(&(&p->tcfa_lock)->rlock);
      
        *** DEADLOCK ***
      
        May be due to missing lock nesting notation
      
       2 locks held by tc/3932:
        #0: 000000007ca8e990 (rtnl_mutex){+.+.}, at: tcf_ife_init+0xf61/0x13c0 [act_ife]
        #1: 000000005097c9a6 (&(&p->tcfa_lock)->rlock){+...}, at: tcf_ife_init+0xf6d/0x13c0 [act_ife]
      
       stack backtrace:
       CPU: 3 PID: 3932 Comm: tc Tainted: G            E     4.17.0-rc4.kasan+ #417
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       Call Trace:
        dump_stack+0x9a/0xeb
        __lock_acquire+0xf43/0x34a0
        ? debug_check_no_locks_freed+0x2b0/0x2b0
        ? debug_check_no_locks_freed+0x2b0/0x2b0
        ? debug_check_no_locks_freed+0x2b0/0x2b0
        ? __mutex_lock+0x62f/0x1240
        ? kvm_sched_clock_read+0x1a/0x30
        ? sched_clock+0x5/0x10
        ? sched_clock_cpu+0x18/0x170
        ? find_held_lock+0x39/0x1d0
        ? lock_acquire+0x10b/0x330
        lock_acquire+0x10b/0x330
        ? tcf_ife_cleanup+0x19/0x80 [act_ife]
        _raw_spin_lock_bh+0x38/0x70
        ? tcf_ife_cleanup+0x19/0x80 [act_ife]
        tcf_ife_cleanup+0x19/0x80 [act_ife]
        __tcf_idr_release+0xff/0x350
        tcf_ife_init+0xdde/0x13c0 [act_ife]
        ? ife_exit_net+0x290/0x290 [act_ife]
        ? __lock_is_held+0xb4/0x140
        tcf_action_init_1+0x67b/0xad0
        ? tcf_action_dump_old+0xa0/0xa0
        ? sched_clock+0x5/0x10
        ? sched_clock_cpu+0x18/0x170
        ? kvm_sched_clock_read+0x1a/0x30
        ? sched_clock+0x5/0x10
        ? sched_clock_cpu+0x18/0x170
        ? memset+0x1f/0x40
        tcf_action_init+0x30f/0x590
        ? tcf_action_init_1+0xad0/0xad0
        ? memset+0x1f/0x40
        tc_ctl_action+0x48e/0x5e0
        ? mutex_lock_io_nested+0x1160/0x1160
        ? tca_action_gd+0x990/0x990
        ? sched_clock+0x5/0x10
        ? find_held_lock+0x39/0x1d0
        rtnetlink_rcv_msg+0x4da/0x990
        ? validate_linkmsg+0x680/0x680
        ? sched_clock_cpu+0x18/0x170
        ? find_held_lock+0x39/0x1d0
        netlink_rcv_skb+0x127/0x350
        ? validate_linkmsg+0x680/0x680
        ? netlink_ack+0x970/0x970
        ? __kmalloc_node_track_caller+0x304/0x3a0
        netlink_unicast+0x40f/0x5d0
        ? netlink_attachskb+0x580/0x580
        ? _copy_from_iter_full+0x187/0x760
        ? import_iovec+0x90/0x390
        netlink_sendmsg+0x67f/0xb50
        ? netlink_unicast+0x5d0/0x5d0
        ? copy_msghdr_from_user+0x206/0x340
        ? netlink_unicast+0x5d0/0x5d0
        sock_sendmsg+0xb3/0xf0
        ___sys_sendmsg+0x60a/0x8b0
        ? copy_msghdr_from_user+0x340/0x340
        ? lock_downgrade+0x5e0/0x5e0
        ? tty_write_lock+0x18/0x50
        ? kvm_sched_clock_read+0x1a/0x30
        ? sched_clock+0x5/0x10
        ? sched_clock_cpu+0x18/0x170
        ? find_held_lock+0x39/0x1d0
        ? lock_downgrade+0x5e0/0x5e0
        ? lock_acquire+0x10b/0x330
        ? __audit_syscall_entry+0x316/0x690
        ? current_kernel_time64+0x6b/0xd0
        ? __fget_light+0x55/0x1f0
        ? __sys_sendmsg+0xd2/0x170
        __sys_sendmsg+0xd2/0x170
        ? __ia32_sys_shutdown+0x70/0x70
        ? syscall_trace_enter+0x57a/0xd60
        ? rcu_read_lock_sched_held+0xdc/0x110
        ? __bpf_trace_sys_enter+0x10/0x10
        ? do_syscall_64+0x22/0x480
        do_syscall_64+0xa5/0x480
        entry_SYSCALL_64_after_hwframe+0x49/0xbe
       RIP: 0033:0x7fd646988ba0
       RSP: 002b:00007fffc9fab3c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
       RAX: ffffffffffffffda RBX: 00007fffc9fab4f0 RCX: 00007fd646988ba0
       RDX: 0000000000000000 RSI: 00007fffc9fab440 RDI: 0000000000000003
       RBP: 000000005b28c8b3 R08: 0000000000000002 R09: 0000000000000000
       R10: 00007fffc9faae20 R11: 0000000000000246 R12: 0000000000000000
       R13: 00007fffc9fab504 R14: 0000000000000001 R15: 000000000066c100
      
      Fixes: 4e8c8615 ("net sched: net sched: ife action fix late binding")
      Fixes: ef6980b6 ("introduce IFE action")
      Signed-off-by: default avatarDavide Caratti <dcaratti@redhat.com>
      Acked-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0a889b94
  11. 23 Apr, 2018 2 commits
  12. 27 Mar, 2018 1 commit
  13. 27 Feb, 2018 1 commit
    • Kirill Tkhai's avatar
      net: Convert tc_action_net_init() and tc_action_net_exit() based pernet_operations · 685ecfb1
      Kirill Tkhai authored
      These pernet_operations are from net/sched directory, and they call only
      tc_action_net_init() and tc_action_net_exit():
      
      bpf_net_ops
      connmark_net_ops
      csum_net_ops
      gact_net_ops
      ife_net_ops
      ipt_net_ops
      xt_net_ops
      mirred_net_ops
      nat_net_ops
      pedit_net_ops
      police_net_ops
      sample_net_ops
      simp_net_ops
      skbedit_net_ops
      skbmod_net_ops
      tunnel_key_net_ops
      vlan_net_ops
      
      1)tc_action_net_init() just allocates and initializes per-net memory.
      2)There should not be in-flight packets at the time of tc_action_net_exit()
      call, or another pernet_operations send packets to dying net (except
      netlink). So, it seems they can be marked as async.
      Signed-off-by: default avatarKirill Tkhai <ktkhai@virtuozzo.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      685ecfb1
  14. 16 Feb, 2018 4 commits
  15. 13 Dec, 2017 1 commit
  16. 05 Dec, 2017 1 commit
  17. 09 Nov, 2017 1 commit
  18. 03 Nov, 2017 1 commit
  19. 15 Oct, 2017 1 commit
  20. 13 Oct, 2017 5 commits
  21. 30 Aug, 2017 1 commit
  22. 29 Aug, 2017 1 commit
  23. 13 Apr, 2017 1 commit