From: Maria Matejka <mq@ucw.cz>
Date: Fri, 23 May 2025 17:17:53 +0000 (+0200)
Subject: Table: fix a race condition in export
X-Git-Tag: v3.0.4~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63df4dcf76f01b0b3f3447a012553a9ea39f8782;p=thirdparty%2Fbird.git

Table: fix a race condition in export

The race condition happens as follows:

- channel A starts feeding
- channel B imports a route ahead of the feeding pointer
- channel A exports this route and continues feeding from the pointer
- no other import hits this specific prefix
- there is at least one channel C which has not cleared this export
- channel A computes ecnt=0 for this prefix because all exports
  have been already cleared
- the condition e >= ecnt mistakenly triggers retry

If the birdloops involved get assigned to the same thread, this race
condition then can't recover and the thread is stuck in an infinite
loop.

Fixed the race condition by moving the consistency check after actually
checking eligibility of the export, not before.

Found by randomly observing performance tests.
---

diff --git a/nest/rt-table.c b/nest/rt-table.c
index fb3cce650..8046bcc86 100644
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -2508,10 +2508,11 @@ rt_net_feed_index(struct rtable_reading *tr, net *n, struct bmap *seen, bool (*p
       uint rpos = rcnt;
       for (const struct rt_pending_export *rpe = first; rpe;
 	  rpe = atomic_load_explicit(&rpe->next, memory_order_acquire))
-	if (e >= ecnt)
-	  RT_READ_RETRY(tr);
-	else if (!seen || !bmap_test(seen, rpe->it.seq))
+	if (!seen || !bmap_test(seen, rpe->it.seq))
 	{
+	  if (e >= ecnt)
+	    RT_READ_RETRY(tr);
+
 	  feed->exports[e++] = rpe->it.seq;
 
 	  /* Copy also obsolete routes */
@@ -2644,10 +2645,11 @@ rt_feed_net_best(struct rt_exporter *e, struct rcu_unwinder *u, u32 index, struc
     uint e = 0;
     for (const struct rt_pending_export *rpe = first; rpe;
 	rpe = atomic_load_explicit(&rpe->next, memory_order_acquire))
-      if (e >= ecnt)
-	RT_READ_RETRY(tr);
-      else if (!seen || !bmap_test(seen, rpe->it.seq))
+      if (!seen || !bmap_test(seen, rpe->it.seq))
       {
+	if (e >= ecnt)
+	  RT_READ_RETRY(tr);
+
 	feed->exports[e++] = rpe->it.seq;
 	if (rpe->it.old && (!best || (rpe->it.old != &best->rte)))
 	{