diff options
| author | Eric Dumazet <edumazet@google.com> | 2025-06-11 11:15:14 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 11:04:10 +0100 |
| commit | eb7b74e9754e1ba2088f914ad1f57a778b11894b (patch) | |
| tree | 0eae6d3c6be0615afee477a5ee0cfd6306254dd4 /net | |
| parent | c05a1bc689596e7b4521c20ef44b5076d31a53e4 (diff) | |
| download | linux-eb7b74e9754e1ba2088f914ad1f57a778b11894b.tar.gz linux-eb7b74e9754e1ba2088f914ad1f57a778b11894b.tar.bz2 linux-eb7b74e9754e1ba2088f914ad1f57a778b11894b.zip | |
net_sched: ets: fix a race in ets_qdisc_change()
[ Upstream commit d92adacdd8c2960be856e0b82acc5b7c5395fddb ]
Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer
fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
|
| [5]: lock root
| [6]: rehash
| [7]: qdisc_tree_reduce_backlog()
|
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
Fixes: b05972f01e7d ("net: sched: tbf: don't call qdisc_put() while holding tree lock")
Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Suggested-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250611111515.1983366-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/sch_ets.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c index 55b3362d2710..4f4da11a2c77 100644 --- a/net/sched/sch_ets.c +++ b/net/sched/sch_ets.c @@ -675,7 +675,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, for (i = q->nbands; i < oldbands; i++) { if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) list_del_init(&q->classes[i].alist); - qdisc_tree_flush_backlog(q->classes[i].qdisc); + qdisc_purge_queue(q->classes[i].qdisc); } q->nstrict = nstrict; memcpy(q->prio2band, priomap, sizeof(priomap)); |