• E
    bridge: fix lockdep splat · 93a33a58
    Eric Dumazet 提交于
    Following lockdep splat was reported :
    
    [   29.382286] ===============================
    [   29.382315] [ INFO: suspicious RCU usage. ]
    [   29.382344] 4.1.0-0.rc0.git11.1.fc23.x86_64 #1 Not tainted
    [   29.382380] -------------------------------
    [   29.382409] net/bridge/br_private.h:626 suspicious
    rcu_dereference_check() usage!
    [   29.382455]
                   other info that might help us debug this:
    
    [   29.382507]
                   rcu_scheduler_active = 1, debug_locks = 0
    [   29.382549] 2 locks held by swapper/0/0:
    [   29.382576]  #0:  (((&p->forward_delay_timer))){+.-...}, at:
    [<ffffffff81139f75>] call_timer_fn+0x5/0x4f0
    [   29.382660]  #1:  (&(&br->lock)->rlock){+.-...}, at:
    [<ffffffffa0450dc1>] br_forward_delay_timer_expired+0x31/0x140
    [bridge]
    [   29.382754]
                   stack backtrace:
    [   29.382787] CPU: 0 PID: 0 Comm: swapper/0 Not tainted
    4.1.0-0.rc0.git11.1.fc23.x86_64 #1
    [   29.382838] Hardware name: LENOVO 422916G/LENOVO, BIOS A1KT53AUS 04/07/2015
    [   29.382882]  0000000000000000 3ebfc20364115825 ffff880666603c48
    ffffffff81892d4b
    [   29.382943]  0000000000000000 ffffffff81e124e0 ffff880666603c78
    ffffffff8110bcd7
    [   29.383004]  ffff8800785c9d00 ffff88065485ac58 ffff880c62002800
    ffff880c5fc88ac0
    [   29.383065] Call Trace:
    [   29.383084]  <IRQ>  [<ffffffff81892d4b>] dump_stack+0x4c/0x65
    [   29.383130]  [<ffffffff8110bcd7>] lockdep_rcu_suspicious+0xe7/0x120
    [   29.383178]  [<ffffffffa04520f9>] br_fill_ifinfo+0x4a9/0x6a0 [bridge]
    [   29.383225]  [<ffffffffa045266b>] br_ifinfo_notify+0x11b/0x4b0 [bridge]
    [   29.383271]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
    [   29.383320]  [<ffffffffa0450de8>]
    br_forward_delay_timer_expired+0x58/0x140 [bridge]
    [   29.383371]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
    [   29.383416]  [<ffffffff8113a033>] call_timer_fn+0xc3/0x4f0
    [   29.383454]  [<ffffffff81139f75>] ? call_timer_fn+0x5/0x4f0
    [   29.383493]  [<ffffffff8110a90f>] ? lock_release_holdtime.part.29+0xf/0x200
    [   29.383541]  [<ffffffffa0450d90>] ? br_hold_timer_expired+0x70/0x70 [bridge]
    [   29.383587]  [<ffffffff8113a6a4>] run_timer_softirq+0x244/0x490
    [   29.383629]  [<ffffffff810b68cc>] __do_softirq+0xec/0x670
    [   29.383666]  [<ffffffff810b70d5>] irq_exit+0x145/0x150
    [   29.383703]  [<ffffffff8189f506>] smp_apic_timer_interrupt+0x46/0x60
    [   29.383744]  [<ffffffff8189d523>] apic_timer_interrupt+0x73/0x80
    [   29.383782]  <EOI>  [<ffffffff816f131f>] ? cpuidle_enter_state+0x5f/0x2f0
    [   29.383832]  [<ffffffff816f131b>] ? cpuidle_enter_state+0x5b/0x2f0
    
    Problem here is that br_forward_delay_timer_expired() is a timer
    handler, calling br_ifinfo_notify() which assumes either rcu_read_lock()
    or RTNL are held.
    
    Simplest fix seems to add rcu read lock section.
    Signed-off-by: NEric Dumazet <edumazet@google.com>
    Reported-by: NJosh Boyer <jwboyer@fedoraproject.org>
    Reported-by: NDominick Grift <dac.override@gmail.com>
    Cc: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    93a33a58
br_stp_timer.c 4.6 KB
/*
 *	Spanning tree protocol; timer-related code
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 */

#include <linux/kernel.h>
#include <linux/times.h>

#include "br_private.h"
#include "br_private_stp.h"

/* called under bridge lock */
static int br_is_designated_for_some_port(const struct net_bridge *br)
{
	struct net_bridge_port *p;

	list_for_each_entry(p, &br->port_list, list) {
		if (p->state != BR_STATE_DISABLED &&
		    !memcmp(&p->designated_bridge, &br->bridge_id, 8))
			return 1;
	}

	return 0;
}

static void br_hello_timer_expired(unsigned long arg)
{
	struct net_bridge *br = (struct net_bridge *)arg;

	br_debug(br, "hello timer expired\n");
	spin_lock(&br->lock);
	if (br->dev->flags & IFF_UP) {
		br_config_bpdu_generation(br);

		mod_timer(&br->hello_timer, round_jiffies(jiffies + br->hello_time));
	}
	spin_unlock(&br->lock);
}

static void br_message_age_timer_expired(unsigned long arg)
{
	struct net_bridge_port *p = (struct net_bridge_port *) arg;
	struct net_bridge *br = p->br;
	const bridge_id *id = &p->designated_bridge;
	int was_root;

	if (p->state == BR_STATE_DISABLED)
		return;

	br_info(br, "port %u(%s) neighbor %.2x%.2x.%pM lost\n",
		(unsigned int) p->port_no, p->dev->name,
		id->prio[0], id->prio[1], &id->addr);

	/*
	 * According to the spec, the message age timer cannot be
	 * running when we are the root bridge. So..  this was_root
	 * check is redundant. I'm leaving it in for now, though.
	 */
	spin_lock(&br->lock);
	if (p->state == BR_STATE_DISABLED)
		goto unlock;
	was_root = br_is_root_bridge(br);

	br_become_designated_port(p);
	br_configuration_update(br);
	br_port_state_selection(br);
	if (br_is_root_bridge(br) && !was_root)
		br_become_root_bridge(br);
 unlock:
	spin_unlock(&br->lock);
}

static void br_forward_delay_timer_expired(unsigned long arg)
{
	struct net_bridge_port *p = (struct net_bridge_port *) arg;
	struct net_bridge *br = p->br;

	br_debug(br, "port %u(%s) forward delay timer\n",
		 (unsigned int) p->port_no, p->dev->name);
	spin_lock(&br->lock);
	if (p->state == BR_STATE_LISTENING) {
		br_set_state(p, BR_STATE_LEARNING);
		mod_timer(&p->forward_delay_timer,
			  jiffies + br->forward_delay);
	} else if (p->state == BR_STATE_LEARNING) {
		br_set_state(p, BR_STATE_FORWARDING);
		if (br_is_designated_for_some_port(br))
			br_topology_change_detection(br);
		netif_carrier_on(br->dev);
	}
	br_log_state(p);
	rcu_read_lock();
	br_ifinfo_notify(RTM_NEWLINK, p);
	rcu_read_unlock();
	spin_unlock(&br->lock);
}

static void br_tcn_timer_expired(unsigned long arg)
{
	struct net_bridge *br = (struct net_bridge *) arg;

	br_debug(br, "tcn timer expired\n");
	spin_lock(&br->lock);
	if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
		br_transmit_tcn(br);

		mod_timer(&br->tcn_timer, jiffies + br->bridge_hello_time);
	}
	spin_unlock(&br->lock);
}

static void br_topology_change_timer_expired(unsigned long arg)
{
	struct net_bridge *br = (struct net_bridge *) arg;

	br_debug(br, "topo change timer expired\n");
	spin_lock(&br->lock);
	br->topology_change_detected = 0;
	br->topology_change = 0;
	spin_unlock(&br->lock);
}

static void br_hold_timer_expired(unsigned long arg)
{
	struct net_bridge_port *p = (struct net_bridge_port *) arg;

	br_debug(p->br, "port %u(%s) hold timer expired\n",
		 (unsigned int) p->port_no, p->dev->name);

	spin_lock(&p->br->lock);
	if (p->config_pending)
		br_transmit_config(p);
	spin_unlock(&p->br->lock);
}

void br_stp_timer_init(struct net_bridge *br)
{
	setup_timer(&br->hello_timer, br_hello_timer_expired,
		      (unsigned long) br);

	setup_timer(&br->tcn_timer, br_tcn_timer_expired,
		      (unsigned long) br);

	setup_timer(&br->topology_change_timer,
		      br_topology_change_timer_expired,
		      (unsigned long) br);

	setup_timer(&br->gc_timer, br_fdb_cleanup, (unsigned long) br);
}

void br_stp_port_timer_init(struct net_bridge_port *p)
{
	setup_timer(&p->message_age_timer, br_message_age_timer_expired,
		      (unsigned long) p);

	setup_timer(&p->forward_delay_timer, br_forward_delay_timer_expired,
		      (unsigned long) p);

	setup_timer(&p->hold_timer, br_hold_timer_expired,
		      (unsigned long) p);
}

/* Report ticks left (in USER_HZ) used for API */
unsigned long br_timer_value(const struct timer_list *timer)
{
	return timer_pending(timer)
		? jiffies_delta_to_clock_t(timer->expires - jiffies) : 0;
}
反馈
建议
客服 返回
顶部