From mboxrd@z Thu Jan 1 00:00:00 1970 From: Magnus Karlsson Subject: [PATCH bpf 4/4] xsk: fix potential race in SKB TX completion code Date: Wed, 27 Jun 2018 16:02:16 +0200 Message-ID: <1530108136-4984-5-git-send-email-magnus.karlsson@intel.com> References: <1530108136-4984-1-git-send-email-magnus.karlsson@intel.com> Cc: qi.z.zhang@intel.com, pavel@fastnetmon.com To: magnus.karlsson@intel.com, bjorn.topel@intel.com, ast@fb.com, daniel@iogearbox.net, netdev@vger.kernel.org Return-path: Received: from mga12.intel.com ([192.55.52.136]:27469 "EHLO mga12.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934584AbeF0OCl (ORCPT ); Wed, 27 Jun 2018 10:02:41 -0400 In-Reply-To: <1530108136-4984-1-git-send-email-magnus.karlsson@intel.com> Sender: netdev-owner@vger.kernel.org List-ID: There was a potential race in the TX completion code for the SKB case when the TX napi thread and the error path of the sendmsg code could both call the SKB destructor at the same time. Fixed by introducing a spin_lock in the destructor. Fixes: 35fcde7f8deb ("xsk: support for Tx") Signed-off-by: Magnus Karlsson --- include/net/xdp_sock.h | 4 ++++ net/xdp/xsk.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h index 9fe472f2ac95..7161856bcf9c 100644 --- a/include/net/xdp_sock.h +++ b/include/net/xdp_sock.h @@ -60,6 +60,10 @@ struct xdp_sock { bool zc; /* Protects multiple processes in the control path */ struct mutex mutex; + /* Mutual exclusion of NAPI TX thread and sendmsg error paths + * in the SKB destructor callback. + */ + spinlock_t tx_completion_lock; u64 rx_dropped; }; diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index d482f727f4c2..650c4da8dc5a 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -199,8 +199,11 @@ static void xsk_destruct_skb(struct sk_buff *skb) { u64 addr = (u64)(long)skb_shinfo(skb)->destructor_arg; struct xdp_sock *xs = xdp_sk(skb->sk); + unsigned long flags; + spin_lock_irqsave(&xs->tx_completion_lock, flags); WARN_ON_ONCE(xskq_produce_addr(xs->umem->cq, addr)); + spin_unlock_irqrestore(&xs->tx_completion_lock, flags); sock_wfree(skb); } @@ -754,6 +757,7 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol, xs = xdp_sk(sk); mutex_init(&xs->mutex); + spin_lock_init(&xs->tx_completion_lock); local_bh_disable(); sock_prot_inuse_add(net, &xsk_proto, 1); -- 2.7.4