diff options
| author |   Eric Dumazet <edumazet@google.com> | 2025-06-11 11:15:11 +0000 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2025-06-12 08:05:49 -0700 |
| commit | d35acc1be3480505b5931f17e4ea9b7617fea4d3 (patch) | |
| tree | d44cad1a7efeca952eafc00c513ad15c50758e29 | |
| parent | net_sched: sch_sfq: reject invalid perturb period (diff) | |
| download | wireguard-linux-d35acc1be3480505b5931f17e4ea9b7617fea4d3.tar.xz wireguard-linux-d35acc1be3480505b5931f17e4ea9b7617fea4d3.zip | |
net_sched: prio: fix a race in prio_tune()
Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer
fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
|
| [5]: lock root
| [6]: rehash
| [7]: qdisc_tree_reduce_backlog()
|
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
Fixes: 7b8e0b6e6599 ("net: sched: prio: delay destroying child qdiscs on change")
Reported-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Suggested-by: Gerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250611111515.1983366-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/sched/sch_prio.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c index cc30f7a32f1a..9e2b9a490db2 100644 --- a/net/sched/sch_prio.c +++ b/net/sched/sch_prio.c @@ -211,7 +211,7 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt, memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1); for (i = q->bands; i < oldbands; i++) - qdisc_tree_flush_backlog(q->queues[i]); + qdisc_purge_queue(q->queues[i]); for (i = oldbands; i < q->bands; i++) { q->queues[i] = queues[i]; |