* [PATCH] rhashtable: add restart routine in rhashtable_free_and_destroy()
@ 2018-07-03 13:19 Taehee Yoo
2018-07-04 5:45 ` Herbert Xu
0 siblings, 1 reply; 3+ messages in thread
From: Taehee Yoo @ 2018-07-03 13:19 UTC (permalink / raw)
To: davem, tgraf, herbert; +Cc: netdev, fw, pablo, ap420073
rhashtable_free_and_destroy() cancels re-hash deferred work
then walks and destroys elements. at this moment, some elements can be
still in future_tbl. that elements are not destroyed.
test case:
nft_rhash_destroy() calls rhashtable_free_and_destroy() to destroy
all elements of sets before destroying sets and chains.
But rhashtable_free_and_destroy() doesn't destroy elements of future_tbl.
so that splat occurred.
test script:
%cat test.nft
table ip aa {
map map1 {
type ipv4_addr : verdict;
elements = {
0 : jump a0,
1 : jump a0,
2 : jump a0,
3 : jump a0,
4 : jump a0,
5 : jump a0,
6 : jump a0,
7 : jump a0,
8 : jump a0,
9 : jump a0,
}
}
chain a0 {
}
}
flush ruleset
table ip aa {
map map1 {
type ipv4_addr : verdict;
elements = {
0 : jump a0,
1 : jump a0,
2 : jump a0,
3 : jump a0,
4 : jump a0,
5 : jump a0,
6 : jump a0,
7 : jump a0,
8 : jump a0,
9 : jump a0,
}
}
chain a0 {
}
}
flush ruleset
%while :; do nft -f test.nft; done
Splat looks like:
[ 200.795603] kernel BUG at net/netfilter/nf_tables_api.c:1363!
[ 200.806944] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 200.812253] CPU: 1 PID: 1582 Comm: nft Not tainted 4.17.0+ #24
[ 200.820297] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015
[ 200.830309] RIP: 0010:nf_tables_chain_destroy.isra.34+0x62/0x240 [nf_tables]
[ 200.838317] Code: 43 50 85 c0 74 26 48 8b 45 00 48 8b 4d 08 ba 54 05 00 00 48 c7 c6 60 6d 29 c0 48 c7 c7 c0 65 29 c0 4c 8b 40 08 e8 58 e5 fd f8 <0f> 0b 48 89 da 48 b8 00 00 00 00 00 fc ff
[ 200.860366] RSP: 0000:ffff880118dbf4d0 EFLAGS: 00010282
[ 200.866354] RAX: 0000000000000061 RBX: ffff88010cdeaf08 RCX: 0000000000000000
[ 200.874355] RDX: 0000000000000061 RSI: 0000000000000008 RDI: ffffed00231b7e90
[ 200.882361] RBP: ffff880118dbf4e8 R08: ffffed002373bcfb R09: ffffed002373bcfa
[ 200.890354] R10: 0000000000000000 R11: ffffed002373bcfb R12: dead000000000200
[ 200.898356] R13: dead000000000100 R14: ffffffffbb62af38 R15: dffffc0000000000
[ 200.906354] FS: 00007fefc31fd700(0000) GS:ffff88011b800000(0000) knlGS:0000000000000000
[ 200.915533] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 200.922355] CR2: 0000557f1c8e9128 CR3: 0000000106880000 CR4: 00000000001006e0
[ 200.930353] Call Trace:
[ 200.932351] ? nf_tables_commit+0x26f6/0x2c60 [nf_tables]
[ 200.939525] ? nf_tables_setelem_notify.constprop.49+0x1a0/0x1a0 [nf_tables]
[ 200.947525] ? nf_tables_delchain+0x6e0/0x6e0 [nf_tables]
[ 200.952383] ? nft_add_set_elem+0x1700/0x1700 [nf_tables]
[ 200.959532] ? nla_parse+0xab/0x230
[ 200.963529] ? nfnetlink_rcv_batch+0xd06/0x10d0 [nfnetlink]
[ 200.968384] ? nfnetlink_net_init+0x130/0x130 [nfnetlink]
[ 200.975525] ? debug_show_all_locks+0x290/0x290
[ 200.980363] ? debug_show_all_locks+0x290/0x290
[ 200.986356] ? sched_clock_cpu+0x132/0x170
[ 200.990352] ? find_held_lock+0x39/0x1b0
[ 200.994355] ? sched_clock_local+0x10d/0x130
[ 200.999531] ? memset+0x1f/0x40
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
---
lib/rhashtable.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 0e04947..8ea27fa 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -1134,6 +1134,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
mutex_lock(&ht->mutex);
tbl = rht_dereference(ht->tbl, ht);
if (free_fn) {
+restart:
for (i = 0; i < tbl->size; i++) {
struct rhash_head *pos, *next;
@@ -1147,9 +1148,11 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
rht_dereference(pos->next, ht) : NULL)
rhashtable_free_one(ht, pos, free_fn, arg);
}
+ tbl = rht_dereference(tbl->future_tbl, ht);
+ if (tbl)
+ goto restart;
}
-
- bucket_table_free(tbl);
+ bucket_table_free(rht_dereference(ht->tbl, ht));
mutex_unlock(&ht->mutex);
}
EXPORT_SYMBOL_GPL(rhashtable_free_and_destroy);
--
2.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] rhashtable: add restart routine in rhashtable_free_and_destroy()
2018-07-03 13:19 [PATCH] rhashtable: add restart routine in rhashtable_free_and_destroy() Taehee Yoo
@ 2018-07-04 5:45 ` Herbert Xu
2018-07-04 13:32 ` Taehee Yoo
0 siblings, 1 reply; 3+ messages in thread
From: Herbert Xu @ 2018-07-04 5:45 UTC (permalink / raw)
To: Taehee Yoo; +Cc: davem, tgraf, netdev, fw, pablo
On Tue, Jul 03, 2018 at 10:19:09PM +0900, Taehee Yoo wrote:
>
> diff --git a/lib/rhashtable.c b/lib/rhashtable.c
> index 0e04947..8ea27fa 100644
> --- a/lib/rhashtable.c
> +++ b/lib/rhashtable.c
> @@ -1134,6 +1134,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
> mutex_lock(&ht->mutex);
> tbl = rht_dereference(ht->tbl, ht);
> if (free_fn) {
> +restart:
> for (i = 0; i < tbl->size; i++) {
> struct rhash_head *pos, *next;
>
> @@ -1147,9 +1148,11 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
> rht_dereference(pos->next, ht) : NULL)
> rhashtable_free_one(ht, pos, free_fn, arg);
> }
> + tbl = rht_dereference(tbl->future_tbl, ht);
> + if (tbl)
> + goto restart;
> }
> -
> - bucket_table_free(tbl);
> + bucket_table_free(rht_dereference(ht->tbl, ht));
Good catch. But don't we need to call bucket_table_free on all
the tables too rather than just the first table?
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] rhashtable: add restart routine in rhashtable_free_and_destroy()
2018-07-04 5:45 ` Herbert Xu
@ 2018-07-04 13:32 ` Taehee Yoo
0 siblings, 0 replies; 3+ messages in thread
From: Taehee Yoo @ 2018-07-04 13:32 UTC (permalink / raw)
To: Herbert Xu; +Cc: davem, tgraf, netdev, Florian Westphal, Pablo Neira Ayuso
2018-07-04 14:45 GMT+09:00 Herbert Xu <herbert@gondor.apana.org.au>:
> On Tue, Jul 03, 2018 at 10:19:09PM +0900, Taehee Yoo wrote:
>>
>> diff --git a/lib/rhashtable.c b/lib/rhashtable.c
>> index 0e04947..8ea27fa 100644
>> --- a/lib/rhashtable.c
>> +++ b/lib/rhashtable.c
>> @@ -1134,6 +1134,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
>> mutex_lock(&ht->mutex);
>> tbl = rht_dereference(ht->tbl, ht);
>> if (free_fn) {
>> +restart:
>> for (i = 0; i < tbl->size; i++) {
>> struct rhash_head *pos, *next;
>>
>> @@ -1147,9 +1148,11 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
>> rht_dereference(pos->next, ht) : NULL)
>> rhashtable_free_one(ht, pos, free_fn, arg);
>> }
>> + tbl = rht_dereference(tbl->future_tbl, ht);
>> + if (tbl)
>> + goto restart;
>> }
>> -
>> - bucket_table_free(tbl);
>> + bucket_table_free(rht_dereference(ht->tbl, ht));
>
Thank you for reviewing!
> Good catch. But don't we need to call bucket_table_free on all
> the tables too rather than just the first table?
>
I haven't thought of it
It seems that all table should be freed.
I will test and send v2 patch.
Thanks!
> Thanks,
> --
> Email: Herbert Xu <herbert@gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-07-04 13:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-07-03 13:19 [PATCH] rhashtable: add restart routine in rhashtable_free_and_destroy() Taehee Yoo
2018-07-04 5:45 ` Herbert Xu
2018-07-04 13:32 ` Taehee Yoo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).