LKML Archive on
help / color / mirror / Atom feed
* [PATCH net] sched: fix infinite loop when creating tc filter
@ 2021-10-10  6:55 Volodymyr Mytnyk
  2021-10-11 13:42 ` Vlad Buslov
  0 siblings, 1 reply; 3+ messages in thread
From: Volodymyr Mytnyk @ 2021-10-10  6:55 UTC (permalink / raw)
  To: netdev
  Cc: Volodymyr Mytnyk, Serhiy Boiko, Jamal Hadi Salim, Cong Wang,
	Jiri Pirko, David S. Miller, Jakub Kicinski, Vlad Buslov,

From: Volodymyr Mytnyk <>

After running a specific set of commands tc will become unresponsive:

  $ ip link add dev DEV type veth
  $ tc qdisc add dev DEV clsact
  $ tc chain add dev DEV chain 0 ingress
  $ tc filter del dev DEV ingress
  $ tc filter add dev DEV ingress flower action pass

When executing chain flush, the "chain->flushing" field is set
to true, which prevents insertion of new classifier instances.
It is unset in one place under two conditions:

`refcnt - chain->action_refcnt == 0` and `!by_act`.

Ignoring the by_act and action_refcnt arguments the `flushing procedure`
will be over when refcnt is 0.

But if the chain is explicitly created (e.g. `tc chain add .. chain 0 ..`)
refcnt is set to 1 without any classifier instances. Thus the condition
is never met and the chain->flushing field is never cleared.
And because the default chain is `flushing` new classifiers cannot
be added. tc_new_tfilter is stuck in a loop trying to find a chain
where chain->flushing is false.

By moving `chain->flushing = false` from __tcf_chain_put to the end
of tcf_chain_flush will avoid the condition and the field will always
be reset after the flush procedure.

Fixes: 91052fa1c657 ("net: sched: protect chain->explicitly_created with block->lock")

Co-developed-by: Serhiy Boiko <>
Signed-off-by: Serhiy Boiko <>
Signed-off-by: Volodymyr Mytnyk <>
 net/sched/cls_api.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d73b5c5514a9..327594cce554 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -563,8 +563,6 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
 	if (refcnt - chain->action_refcnt == 0 && !by_act) {
 		tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index,
 				       block, NULL, 0, 0, false);
-		/* Last reference to chain, no need to lock. */
-		chain->flushing = false;
 	if (refcnt == 0)
@@ -615,6 +613,9 @@ static void tcf_chain_flush(struct tcf_chain *chain, bool rtnl_held)
 		tcf_proto_put(tp, rtnl_held, NULL);
 		tp = tp_next;
+	/* Last reference to chain, no need to lock. */
+	chain->flushing = false;
 static int tcf_block_setup(struct tcf_block *block,

^ permalink raw reply related	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-10-13  9:44 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-10  6:55 [PATCH net] sched: fix infinite loop when creating tc filter Volodymyr Mytnyk
2021-10-11 13:42 ` Vlad Buslov
2021-10-13  9:43   ` Volodymyr Mytnyk [C]

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).