Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751784AbdG1Dvu (ORCPT ); Thu, 27 Jul 2017 23:51:50 -0400 Received: from mx3.wp.pl ([212.77.101.10]:41242 "EHLO mx3.wp.pl" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751755AbdG1Dvs (ORCPT ); Thu, 27 Jul 2017 23:51:48 -0400 Date: Thu, 27 Jul 2017 20:51:40 -0700 From: Jakub Kicinski To: "Michael S. Tsirkin" Cc: Jason Wang , davem@davemloft.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH net-next 3/3] tap: XDP support Message-ID: <20170727205140.2b3ca38a@cakuba.netronome.com> In-Reply-To: <20170728064603-mutt-send-email-mst@kernel.org> References: <1501147533-12368-1-git-send-email-jasowang@redhat.com> <1501147533-12368-4-git-send-email-jasowang@redhat.com> <20170727201338.65d56b2a@cakuba.netronome.com> <7d1cb7bf-43c1-3993-be00-04e4676dd917@redhat.com> <20170728064603-mutt-send-email-mst@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-WP-MailID: 9e65f42f4b0b426a9732cb3606605003 X-WP-AV: skaner antywirusowy Poczty Wirtualnej Polski X-WP-SPAM: NO 0000000 [AaP3] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1197 Lines: 30 On Fri, 28 Jul 2017 06:46:40 +0300, Michael S. Tsirkin wrote: > On Fri, Jul 28, 2017 at 11:28:54AM +0800, Jason Wang wrote: > > > > + old_prog = rtnl_dereference(tun->xdp_prog); > > > > + if (old_prog) > > > > + bpf_prog_put(old_prog); > > > > + rcu_assign_pointer(tun->xdp_prog, prog); > > > Is this OK? Could this lead to the program getting freed and then > > > datapath accessing a stale pointer? I mean in the scenario where the > > > process gets pre-empted between the bpf_prog_put() and > > > rcu_assign_pointer()? > > > > Will call bpf_prog_put() after rcu_assign_pointer(). > > I suspect you need to sync RCU or something before that. I think the bpf_prog_put() will use call_rcu() to do the actual free: static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock) { if (atomic_dec_and_test(&prog->aux->refcnt)) { trace_bpf_prog_put_rcu(prog); /* bpf_prog_free_id() must be called first */ bpf_prog_free_id(prog, do_idr_lock); bpf_prog_kallsyms_del(prog); call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu); } } It's just that we are only under the rtnl here, RCU lock is not held, so grace period may elapse between bpf_prog_put() and rcu_assign_pointer().