net_sched: hold netns refcnt for each action
TC actions have been destroyed asynchronously for a long time,
previously in a RCU callback and now in a workqueue. If we
don't hold a refcnt for its netns, we could use the per netns
data structure, struct tcf_idrinfo, after it has been freed by
netns workqueue.
Hold refcnt to ensure netns destroy happens after all actions
are gone.
Fixes: ddf97ccdd7 ("net_sched: add network namespace support for tc actions")
Reported-by: Lucas Bates <lucasb@mojatatu.com>
Tested-by: Lucas Bates <lucasb@mojatatu.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
committed by
David S. Miller
parent
a159d3c4b8
commit
ceffcc5e25
@ -13,6 +13,7 @@
|
||||
struct tcf_idrinfo {
|
||||
spinlock_t lock;
|
||||
struct idr action_idr;
|
||||
struct net *net;
|
||||
};
|
||||
|
||||
struct tc_action_ops;
|
||||
@ -104,7 +105,7 @@ struct tc_action_net {
|
||||
|
||||
static inline
|
||||
int tc_action_net_init(struct tc_action_net *tn,
|
||||
const struct tc_action_ops *ops)
|
||||
const struct tc_action_ops *ops, struct net *net)
|
||||
{
|
||||
int err = 0;
|
||||
|
||||
@ -112,6 +113,7 @@ int tc_action_net_init(struct tc_action_net *tn,
|
||||
if (!tn->idrinfo)
|
||||
return -ENOMEM;
|
||||
tn->ops = ops;
|
||||
tn->idrinfo->net = net;
|
||||
spin_lock_init(&tn->idrinfo->lock);
|
||||
idr_init(&tn->idrinfo->action_idr);
|
||||
return err;
|
||||
|
||||
Reference in New Issue
Block a user