[PATCH net-next] net: tipc: remove one synchronize_net() from tipc_nametbl_stop()

[PATCH net-next] net: tipc: remove one synchronize_net() from tipc_nametbl_stop()

[Eric Dumazet]

tipc_exit_net() is very slow and is abused by syzbot.

tipc_nametbl_stop() is called for each netns being dismantled.

Calling synchronize_net() right before freeing tn->nametbl
is a big hammer.

Replace this with kfree_rcu().

Note that RCU is not properly used here, otherwise
tn->nametbl should be cleared before the synchronize_net()
or kfree_rcu(), or even before the cleanup loop.

We might need to fix this at some point.

Also note tipc uses other synchronize_rcu() calls,
more work is needed to make tipc_exit_net() much faster.

List of remaining calls to synchronize_rcu()

  tipc_detach_loopback() (dev_remove_pack())
  tipc_bcast_stop()
  tipc_sk_rht_destroy()

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: tipc-discussion@lists.sourceforge.net
---
 net/tipc/name_table.c | 4 ++--
 net/tipc/name_table.h | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index d1180370fdf41cb05c86522b4da6aa412a54cce9..e74940eab3a47901d49b552767b16793c4459aa2 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -949,8 +949,8 @@ void tipc_nametbl_stop(struct net *net)
 	}
 	spin_unlock_bh(&tn->nametbl_lock);
 
-	synchronize_net();
-	kfree(nt);
+	/* TODO: clear tn->nametbl, implement proper RCU rules ? */
+	kfree_rcu(nt, rcu);
 }
 
 static int __tipc_nl_add_nametable_publ(struct tipc_nl_msg *msg,
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 3bcd9ef8cee3046f09b07901b87e344f42253d69..7ff6eeebaae643c31f8395cb14d3b6b8d8cd2610 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -90,6 +90,7 @@ struct publication {
 
 /**
  * struct name_table - table containing all existing port name publications
+ * @rcu: RCU callback head used for deferred freeing
  * @services: name sequence hash lists
  * @node_scope: all local publications with node scope
  *               - used by name_distr during re-init of name table
@@ -102,6 +103,7 @@ struct publication {
  * @snd_nxt: next sequence number to be used
  */
 struct name_table {
+	struct rcu_head rcu;
 	struct hlist_head services[TIPC_NAMETBL_SIZE];
 	struct list_head node_scope;
 	struct list_head cluster_scope;
-- 
2.47.0.338.g60cca15819-goog

Re: [PATCH net-next] net: tipc: remove one synchronize_net() from tipc_nametbl_stop()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  4 Dec 2024 21:02:34 +0000 you wrote:
> tipc_exit_net() is very slow and is abused by syzbot.
> 
> tipc_nametbl_stop() is called for each netns being dismantled.
> 
> Calling synchronize_net() right before freeing tn->nametbl
> is a big hammer.
> 
> [...]

Here is the summary with links:
  - [net-next] net: tipc: remove one synchronize_net() from tipc_nametbl_stop()
    https://git.kernel.org/netdev/net-next/c/6c36b5c244d6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html