Commit 43eb4660 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

net_sched: tbf: fix a race in tbf_change() 



Gerrard Tai reported a race condition in TBF, whenever SFQ perturb timer
fires at the wrong time.

The race is as follows:

CPU 0                                 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
 |
 |                                    [5]: lock root
 |                                    [6]: rehash
 |                                    [7]: qdisc_tree_reduce_backlog()
 |
[4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.

Fixes: b05972f0 ("net: sched: tbf: don't call qdisc_put() while holding tree lock")
Reported-by: default avatarGerrard Tai <gerrard.tai@starlabs.sg>
Suggested-by: default avatarGerrard Tai <gerrard.tai@starlabs.sg>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Zhengchao Shao <shaozhengchao@huawei.com>
Link: https://patch.msgid.link/20250611111515.1983366-4-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 85a3e0ed

net/sched/sch_tbf.c

+1 −1
Original line number Diff line number Diff line
@@ -452,7 +452,7 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt, 


	sch_tree_lock(sch);

	if (child) {

		qdisc_tree_flush_backlog(q->qdisc);

		qdisc_purge_queue(q->qdisc);

		old = q->qdisc;

		q->qdisc = child;

	}