net: Fix data-races around weight_p and dev_weight_[rt]x_bias.

BugLink: https://bugs.launchpad.net/bugs/1991717
[ Upstream commit bf955b5ab8f6f7b0632cdef8e36b14e4f6e77829 ]

While reading weight_p, it can be changed concurrently.  Thus, we need
to add READ_ONCE() to its reader.

Also, dev_[rt]x_weight can be read/written at the same time.  So, we
need to use READ_ONCE() and WRITE_ONCE() for its access.  Moreover, to
use the same weight_p while changing dev_[rt]x_weight, we add a mutex
in proc_do_dev_weight().

Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/core/dev.c b/net/core/dev.c
index 12b1811cb488b0daf92f68b300fbde72457a1bf8..1a0de071fcf45ec3c827194739680239edb80410 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6437,7 +6437,7 @@ static int process_backlog(struct napi_struct *napi, int quota)
                net_rps_action_and_irq_enable(sd);
        }
 
-       napi->weight = dev_rx_weight;
+       napi->weight = READ_ONCE(dev_rx_weight);
        while (again) {
                struct sk_buff *skb;
 

diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 5f88526ad61cc9480ba02cc2318711942d73a655..ed20cbdd19315f286da884cc2946d72971ebad1a 100644 (file)
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -236,14 +236,17 @@ static int set_default_qdisc(struct ctl_table *table, int write,
 static int proc_do_dev_weight(struct ctl_table *table, int write,
                           void *buffer, size_t *lenp, loff_t *ppos)
 {
-       int ret;
+       static DEFINE_MUTEX(dev_weight_mutex);
+       int ret, weight;
 
+       mutex_lock(&dev_weight_mutex);
        ret = proc_dointvec(table, write, buffer, lenp, ppos);
-       if (ret != 0)
-               return ret;
-
-       dev_rx_weight = weight_p * dev_weight_rx_bias;
-       dev_tx_weight = weight_p * dev_weight_tx_bias;
+       if (!ret && write) {
+               weight = READ_ONCE(weight_p);
+               WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias);
+               WRITE_ONCE(dev_tx_weight, weight * dev_weight_tx_bias);
+       }
+       mutex_unlock(&dev_weight_mutex);
 
        return ret;
 }

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 30c29a9a2efd25274f7ef4805ed6dc7ebeed7639..250d87d993cb7a9f14b0af6f4b7a084b3097d479 100644 (file)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -409,7 +409,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)
 
 void __qdisc_run(struct Qdisc *q)
 {
-       int quota = dev_tx_weight;
+       int quota = READ_ONCE(dev_tx_weight);
        int packets;
 
        while (qdisc_restart(q, &packets)) {