From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net-next] net_sched: remove the unsafe __skb_array_empty() Date: Thu, 21 Dec 2017 16:03:30 -0800 Message-ID: <20171222000330.29009-2-xiyou.wangcong@gmail.com> References: <20171222000330.29009-1-xiyou.wangcong@gmail.com> Cc: jakub.kicinski@netronome.com, Cong Wang , John Fastabend To: netdev@vger.kernel.org Return-path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:34795 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752875AbdLVADo (ORCPT ); Thu, 21 Dec 2017 19:03:44 -0500 Received: by mail-pg0-f65.google.com with SMTP id j4so13877869pgp.1 for ; Thu, 21 Dec 2017 16:03:43 -0800 (PST) In-Reply-To: <20171222000330.29009-1-xiyou.wangcong@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: __skb_array_empty() is only safe if array is never resized. pfifo_fast_dequeue() is called in TX BH context and without qdisc lock, so even after we disable BH on ->reset() path we can still race with other CPU's. Fixes: c5ad119fb6c0 ("net: sched: pfifo_fast use skb_array") Reported-by: Jakub Kicinski Cc: John Fastabend Signed-off-by: Cong Wang --- net/sched/sch_generic.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 00ddb5f8f430..9279258ce060 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -622,9 +622,6 @@ static struct sk_buff *pfifo_fast_dequeue(struct Qdisc *qdisc) for (band = 0; band < PFIFO_FAST_BANDS && !skb; band++) { struct skb_array *q = band2list(priv, band); - if (__skb_array_empty(q)) - continue; - skb = skb_array_consume_bh(q); } if (likely(skb)) { -- 2.13.0