From mboxrd@z Thu Jan  1 00:00:00 1970
From: Cong Wang <xiyou.wangcong@gmail.com>
Subject: Re: [Patch net-next v3] net_sched: change tcf_del_walker() to take idrinfo->lock
Date: Fri, 28 Sep 2018 21:47:36 -0700
Message-ID: <CAM_iQpVpmJ76vs4j0eaDWCJiXDjZA8Uj_ozS8gp5RZBpAV-zCQ@mail.gmail.com>
References: <20180919233729.10951-1-xiyou.wangcong@gmail.com>
 <20180928145900.GA17640@splinter> <CAM_iQpUav4UK6uzpaZejFiLn_eEbbvZQry7G6JgzSkj_Eq0fyQ@mail.gmail.com>
 <20180928181114.GA28797@splinter> <CAM_iQpXQXwwRvzuCpkrBY6cwgi8vX1mymy_ca3H4rfjrAha58Q@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Cc: Linux Kernel Network Developers <netdev@vger.kernel.org>,
        Jiri Pirko <jiri@resnulli.us>,
        Jamal Hadi Salim <jhs@mojatatu.com>,
        Vlad Buslov <vladbu@mellanox.com>
To: Ido Schimmel <idosch@idosch.org>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pf1-f180.google.com ([209.85.210.180]:36911 "EHLO
        mail-pf1-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1727351AbeI2LBW (ORCPT
        <rfc822;netdev@vger.kernel.org>); Sat, 29 Sep 2018 07:01:22 -0400
Received: by mail-pf1-f180.google.com with SMTP id x26-v6so5595278pfn.4
        for <netdev@vger.kernel.org>; Fri, 28 Sep 2018 21:34:29 -0700 (PDT)
In-Reply-To: <CAM_iQpXQXwwRvzuCpkrBY6cwgi8vX1mymy_ca3H4rfjrAha58Q@mail.gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Fri, Sep 28, 2018 at 11:29 AM Cong Wang <xiyou.wangcong@gmail.com> wrote:
>
> On Fri, Sep 28, 2018 at 11:11 AM Ido Schimmel <idosch@idosch.org> wrote:
> > I don't think this will work given the reference count already dropped
> > to 0, which is why the template deletion function was invoked. I didn't
> > test the patch, but I don't see what would prevent the chain from being
> > freed.
>
> Good catch! So I should just "move" tcf_chain_destroy() into cls_flower.
>
> A patch is being compiled now.

Just FYI, the crash is fixed, but another RCU warning pops up after
my fix. So I am still debugging it, it is related to the kfree_rcu() in
tcf_chain_destroy().