net_sched: sch_sfq: annotate data-races around q->perturb_period

commit a17ef9e6c2c1cf0fc6cd6ca6a9ce525c67d1da7f upstream.

sfq_perturbation() reads q->perturb_period locklessly.
Add annotations to fix potential issues.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240430180015.3111398-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8cd4e663575c60225ddbd4c4ba714da671e0860c..31a9bd0a7096309af951653006a4b735bba80f27 100644 (file)
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -611,6 +611,7 @@ static void sfq_perturbation(struct timer_list *t)
        struct Qdisc *sch = q->sch;
        spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
        siphash_key_t nkey;
+       int period;
 
        get_random_bytes(&nkey, sizeof(nkey));
        spin_lock(root_lock);
@@ -619,8 +620,12 @@ static void sfq_perturbation(struct timer_list *t)
                sfq_rehash(sch);
        spin_unlock(root_lock);
 
-       if (q->perturb_period)
-               mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
+       /* q->perturb_period can change under us from
+        * sfq_change() and sfq_destroy().
+        */
+       period = READ_ONCE(q->perturb_period);
+       if (period)
+               mod_timer(&q->perturb_timer, jiffies + period);
 }
 
 static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
@@ -662,7 +667,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
                q->quantum = ctl->quantum;
                q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
        }
-       q->perturb_period = ctl->perturb_period * HZ;
+       WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ);
        if (ctl->flows)
                q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS);
        if (ctl->divisor) {
@@ -724,7 +729,7 @@ static void sfq_destroy(struct Qdisc *sch)
        struct sfq_sched_data *q = qdisc_priv(sch);
 
        tcf_block_put(q->block);
-       q->perturb_period = 0;
+       WRITE_ONCE(q->perturb_period, 0);
        del_timer_sync(&q->perturb_timer);
        sfq_free(q->ht);
        sfq_free(q->slots);