Flower classifier only changes root pointer during init and destroy. Cls
API implements reference counting for tcf_proto, so there is no danger of
concurrent access to tp when it is being destroyed, even without protection
provided by rtnl lock.

Implement new function fl_head_dereference() to dereference tp->root
without checking for rtnl lock. Use it in all flower function that obtain
head pointer instead of rtnl_dereference().

Signed-off-by: Vlad Buslov <vla...@mellanox.com>
---
Changes from V1 to V2:
  - Use rcu_dereference_raw() for tp->root dereference.
  - Update comment in fl_head_dereference().

 net/sched/cls_flower.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 27300a3e76c7..37bced9e2672 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -437,10 +437,20 @@ static void fl_hw_update_stats(struct tcf_proto *tp, 
struct cls_fl_filter *f)
                              cls_flower.stats.lastused);
 }
 
+static struct cls_fl_head *fl_head_dereference(struct tcf_proto *tp)
+{
+       /* Flower classifier only changes root pointer during init and destroy.
+        * Users must obtain reference to tcf_proto instance before calling its
+        * API, so tp->root pointer is protected from concurrent call to
+        * fl_destroy() by reference counting.
+        */
+       return rcu_dereference_raw(tp->root);
+}
+
 static bool __fl_delete(struct tcf_proto *tp, struct cls_fl_filter *f,
                        struct netlink_ext_ack *extack)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        bool async = tcf_exts_get_net(&f->exts);
        bool last;
 
@@ -472,7 +482,7 @@ static void fl_destroy_sleepable(struct work_struct *work)
 static void fl_destroy(struct tcf_proto *tp, bool rtnl_held,
                       struct netlink_ext_ack *extack)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        struct fl_flow_mask *mask, *next_mask;
        struct cls_fl_filter *f, *next;
 
@@ -490,7 +500,7 @@ static void fl_destroy(struct tcf_proto *tp, bool rtnl_held,
 
 static void *fl_get(struct tcf_proto *tp, u32 handle)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
 
        return idr_find(&head->handle_idr, handle);
 }
@@ -1308,7 +1318,7 @@ static int fl_change(struct net *net, struct sk_buff 
*in_skb,
                     void **arg, bool ovr, bool rtnl_held,
                     struct netlink_ext_ack *extack)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        struct cls_fl_filter *fold = *arg;
        struct cls_fl_filter *fnew;
        struct fl_flow_mask *mask;
@@ -1445,7 +1455,7 @@ static int fl_change(struct net *net, struct sk_buff 
*in_skb,
 static int fl_delete(struct tcf_proto *tp, void *arg, bool *last,
                     bool rtnl_held, struct netlink_ext_ack *extack)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        struct cls_fl_filter *f = arg;
 
        rhashtable_remove_fast(&f->mask->ht, &f->ht_node,
@@ -1458,7 +1468,7 @@ static int fl_delete(struct tcf_proto *tp, void *arg, 
bool *last,
 static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
                    bool rtnl_held)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        struct cls_fl_filter *f;
 
        arg->count = arg->skip;
@@ -1477,7 +1487,7 @@ static void fl_walk(struct tcf_proto *tp, struct 
tcf_walker *arg,
 static int fl_reoffload(struct tcf_proto *tp, bool add, tc_setup_cb_t *cb,
                        void *cb_priv, struct netlink_ext_ack *extack)
 {
-       struct cls_fl_head *head = rtnl_dereference(tp->root);
+       struct cls_fl_head *head = fl_head_dereference(tp);
        struct tc_cls_flower_offload cls_flower = {};
        struct tcf_block *block = tp->chain->block;
        struct fl_flow_mask *mask;
-- 
2.13.6

Reply via email to