Commit 86723c86 authored by Toshiaki Makita's avatar Toshiaki Makita Committed by Daniel Borkmann

bpf, devmap: Add missing RCU read lock on flush

.ndo_xdp_xmit() assumes it is called under RCU. For example virtio_net
uses RCU to detect it has setup the resources for tx. The assumption
accidentally broke when introducing bulk queue in devmap.

Fixes: 5d053f9d ("bpf: devmap prepare xdp frames for bulking")
Reported-by: default avatarDavid Ahern <dsahern@gmail.com>
Signed-off-by: default avatarToshiaki Makita <toshiaki.makita1@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent edabf4d9
...@@ -282,6 +282,7 @@ void __dev_map_flush(struct bpf_map *map) ...@@ -282,6 +282,7 @@ void __dev_map_flush(struct bpf_map *map)
unsigned long *bitmap = this_cpu_ptr(dtab->flush_needed); unsigned long *bitmap = this_cpu_ptr(dtab->flush_needed);
u32 bit; u32 bit;
rcu_read_lock();
for_each_set_bit(bit, bitmap, map->max_entries) { for_each_set_bit(bit, bitmap, map->max_entries) {
struct bpf_dtab_netdev *dev = READ_ONCE(dtab->netdev_map[bit]); struct bpf_dtab_netdev *dev = READ_ONCE(dtab->netdev_map[bit]);
struct xdp_bulk_queue *bq; struct xdp_bulk_queue *bq;
...@@ -297,6 +298,7 @@ void __dev_map_flush(struct bpf_map *map) ...@@ -297,6 +298,7 @@ void __dev_map_flush(struct bpf_map *map)
__clear_bit(bit, bitmap); __clear_bit(bit, bitmap);
} }
rcu_read_unlock();
} }
/* rcu_read_lock (from syscall and BPF contexts) ensures that if a delete and/or /* rcu_read_lock (from syscall and BPF contexts) ensures that if a delete and/or
...@@ -389,6 +391,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev) ...@@ -389,6 +391,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
int cpu; int cpu;
rcu_read_lock();
for_each_online_cpu(cpu) { for_each_online_cpu(cpu) {
bitmap = per_cpu_ptr(dev->dtab->flush_needed, cpu); bitmap = per_cpu_ptr(dev->dtab->flush_needed, cpu);
__clear_bit(dev->bit, bitmap); __clear_bit(dev->bit, bitmap);
...@@ -396,6 +399,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev) ...@@ -396,6 +399,7 @@ static void dev_map_flush_old(struct bpf_dtab_netdev *dev)
bq = per_cpu_ptr(dev->bulkq, cpu); bq = per_cpu_ptr(dev->bulkq, cpu);
bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false); bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false);
} }
rcu_read_unlock();
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment