diff options
| author | Eric Dumazet <[email protected]> | 2025-06-11 11:15:14 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2025-06-12 15:05:50 +0000 |
| commit | d92adacdd8c2960be856e0b82acc5b7c5395fddb (patch) | |
| tree | 47f8d3e61bd87a9abe67ef44ad33a9ea3a87b2a3 /drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | |
| parent | net_sched: tbf: fix a race in tbf_change() (diff) | |
| download | kernel-d92adacdd8c2960be856e0b82acc5b7c5395fddb.tar.gz kernel-d92adacdd8c2960be856e0b82acc5b7c5395fddb.zip | |
net_sched: ets: fix a race in ets_qdisc_change()
Gerrard Tai reported a race condition in ETS, whenever SFQ perturb timer
fires at the wrong time.
The race is as follows:
CPU 0 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
|
| [5]: lock root
| [6]: rehash
| [7]: qdisc_tree_reduce_backlog()
|
[4]: qdisc_put()
This can be abused to underflow a parent's qlen.
Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.
Fixes: b05972f01e7d ("net: sched: tbf: don't call qdisc_put() while holding tree lock")
Reported-by: Gerrard Tai <[email protected]>
Suggested-by: Gerrard Tai <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c')
0 files changed, 0 insertions, 0 deletions