]>
Commit | Line | Data |
---|---|---|
5351d7ec GKH |
1 | From foo@baz Fri Mar 9 14:18:36 PST 2018 |
2 | From: Daniel Borkmann <daniel@iogearbox.net> | |
3 | Date: Thu, 8 Mar 2018 13:14:42 +0100 | |
4 | Subject: bpf: fix rcu lockdep warning for lpm_trie map_free callback | |
5 | To: gregkh@linuxfoundation.org | |
6 | Cc: ast@kernel.org, daniel@iogearbox.net, stable@vger.kernel.org, Yonghong Song <yhs@fb.com> | |
7 | Message-ID: <8858404a8f3ea0fc0a60e045a02f7714ad6bbb01.1520504748.git.daniel@iogearbox.net> | |
8 | ||
9 | From: Yonghong Song <yhs@fb.com> | |
10 | ||
11 | [ upstream commit 6c5f61023c5b0edb0c8a64c902fe97c6453b1852 ] | |
12 | ||
13 | Commit 9a3efb6b661f ("bpf: fix memory leak in lpm_trie map_free callback function") | |
14 | fixed a memory leak and removed unnecessary locks in map_free callback function. | |
15 | Unfortrunately, it introduced a lockdep warning. When lockdep checking is turned on, | |
16 | running tools/testing/selftests/bpf/test_lpm_map will have: | |
17 | ||
18 | [ 98.294321] ============================= | |
19 | [ 98.294807] WARNING: suspicious RCU usage | |
20 | [ 98.295359] 4.16.0-rc2+ #193 Not tainted | |
21 | [ 98.295907] ----------------------------- | |
22 | [ 98.296486] /home/yhs/work/bpf/kernel/bpf/lpm_trie.c:572 suspicious rcu_dereference_check() usage! | |
23 | [ 98.297657] | |
24 | [ 98.297657] other info that might help us debug this: | |
25 | [ 98.297657] | |
26 | [ 98.298663] | |
27 | [ 98.298663] rcu_scheduler_active = 2, debug_locks = 1 | |
28 | [ 98.299536] 2 locks held by kworker/2:1/54: | |
29 | [ 98.300152] #0: ((wq_completion)"events"){+.+.}, at: [<00000000196bc1f0>] process_one_work+0x157/0x5c0 | |
30 | [ 98.301381] #1: ((work_completion)(&map->work)){+.+.}, at: [<00000000196bc1f0>] process_one_work+0x157/0x5c0 | |
31 | ||
32 | Since actual trie tree removal happens only after no other | |
33 | accesses to the tree are possible, replacing | |
34 | rcu_dereference_protected(*slot, lockdep_is_held(&trie->lock)) | |
35 | with | |
36 | rcu_dereference_protected(*slot, 1) | |
37 | fixed the issue. | |
38 | ||
39 | Fixes: 9a3efb6b661f ("bpf: fix memory leak in lpm_trie map_free callback function") | |
40 | Reported-by: Eric Dumazet <edumazet@google.com> | |
41 | Suggested-by: Eric Dumazet <edumazet@google.com> | |
42 | Signed-off-by: Yonghong Song <yhs@fb.com> | |
43 | Reviewed-by: Eric Dumazet <edumazet@google.com> | |
44 | Acked-by: David S. Miller <davem@davemloft.net> | |
45 | Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> | |
46 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
47 | --- | |
48 | kernel/bpf/lpm_trie.c | 3 +-- | |
49 | 1 file changed, 1 insertion(+), 2 deletions(-) | |
50 | ||
51 | --- a/kernel/bpf/lpm_trie.c | |
52 | +++ b/kernel/bpf/lpm_trie.c | |
53 | @@ -484,8 +484,7 @@ static void trie_free(struct bpf_map *ma | |
54 | slot = &trie->root; | |
55 | ||
56 | for (;;) { | |
57 | - node = rcu_dereference_protected(*slot, | |
58 | - lockdep_is_held(&trie->lock)); | |
59 | + node = rcu_dereference_protected(*slot, 1); | |
60 | if (!node) | |
61 | goto out; | |
62 |