080-20-fib_trie-Fix-RCU-bug-and-merge-similar-bits-of-infla.patch 8.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267
  1. From: Alexander Duyck <alexander.h.duyck@redhat.com>
  2. Date: Thu, 22 Jan 2015 15:51:14 -0800
  3. Subject: [PATCH] fib_trie: Fix RCU bug and merge similar bits of inflate/halve
  4. This patch addresses two issues.
  5. The first issue is the fact that I believe I had the RCU freeing sequence
  6. slightly out of order. As a result we could get into an issue if a caller
  7. went into a child of a child of the new node, then backtraced into the to be
  8. freed parent, and then attempted to access a child of a child that may have
  9. been consumed in a resize of one of the new nodes children. To resolve this I
  10. have moved the resize after we have freed the oldtnode. The only side effect
  11. of this is that we will now be calling resize on more nodes in the case of
  12. inflate due to the fact that we don't have a good way to test to see if a
  13. full_tnode on the new node was there before or after the allocation. This
  14. should have minimal impact however since the node should already be
  15. correctly size so it is just the cost of calling should_inflate that we
  16. will be taking on the node which is only a couple of cycles.
  17. The second issue is the fact that inflate and halve were essentially doing
  18. the same thing after the new node was added to the trie replacing the old
  19. one. As such it wasn't really necessary to keep the code in both functions
  20. so I have split it out into two other functions, called replace and
  21. update_children.
  22. Signed-off-by: Alexander Duyck <alexander.h.duyck@redhat.com>
  23. Signed-off-by: David S. Miller <davem@davemloft.net>
  24. ---
  25. --- a/net/ipv4/fib_trie.c
  26. +++ b/net/ipv4/fib_trie.c
  27. @@ -396,8 +396,30 @@ static void put_child(struct tnode *tn,
  28. rcu_assign_pointer(tn->child[i], n);
  29. }
  30. -static void put_child_root(struct tnode *tp, struct trie *t,
  31. - t_key key, struct tnode *n)
  32. +static void update_children(struct tnode *tn)
  33. +{
  34. + unsigned long i;
  35. +
  36. + /* update all of the child parent pointers */
  37. + for (i = tnode_child_length(tn); i;) {
  38. + struct tnode *inode = tnode_get_child(tn, --i);
  39. +
  40. + if (!inode)
  41. + continue;
  42. +
  43. + /* Either update the children of a tnode that
  44. + * already belongs to us or update the child
  45. + * to point to ourselves.
  46. + */
  47. + if (node_parent(inode) == tn)
  48. + update_children(inode);
  49. + else
  50. + node_set_parent(inode, tn);
  51. + }
  52. +}
  53. +
  54. +static inline void put_child_root(struct tnode *tp, struct trie *t,
  55. + t_key key, struct tnode *n)
  56. {
  57. if (tp)
  58. put_child(tp, get_index(key, tp), n);
  59. @@ -434,10 +456,35 @@ static void tnode_free(struct tnode *tn)
  60. }
  61. }
  62. +static void replace(struct trie *t, struct tnode *oldtnode, struct tnode *tn)
  63. +{
  64. + struct tnode *tp = node_parent(oldtnode);
  65. + unsigned long i;
  66. +
  67. + /* setup the parent pointer out of and back into this node */
  68. + NODE_INIT_PARENT(tn, tp);
  69. + put_child_root(tp, t, tn->key, tn);
  70. +
  71. + /* update all of the child parent pointers */
  72. + update_children(tn);
  73. +
  74. + /* all pointers should be clean so we are done */
  75. + tnode_free(oldtnode);
  76. +
  77. + /* resize children now that oldtnode is freed */
  78. + for (i = tnode_child_length(tn); i;) {
  79. + struct tnode *inode = tnode_get_child(tn, --i);
  80. +
  81. + /* resize child node */
  82. + if (tnode_full(tn, inode))
  83. + resize(t, inode);
  84. + }
  85. +}
  86. +
  87. static int inflate(struct trie *t, struct tnode *oldtnode)
  88. {
  89. - struct tnode *inode, *node0, *node1, *tn, *tp;
  90. - unsigned long i, j, k;
  91. + struct tnode *tn;
  92. + unsigned long i;
  93. t_key m;
  94. pr_debug("In inflate\n");
  95. @@ -446,13 +493,18 @@ static int inflate(struct trie *t, struc
  96. if (!tn)
  97. return -ENOMEM;
  98. + /* prepare oldtnode to be freed */
  99. + tnode_free_init(oldtnode);
  100. +
  101. /* Assemble all of the pointers in our cluster, in this case that
  102. * represents all of the pointers out of our allocated nodes that
  103. * point to existing tnodes and the links between our allocated
  104. * nodes.
  105. */
  106. for (i = tnode_child_length(oldtnode), m = 1u << tn->pos; i;) {
  107. - inode = tnode_get_child(oldtnode, --i);
  108. + struct tnode *inode = tnode_get_child(oldtnode, --i);
  109. + struct tnode *node0, *node1;
  110. + unsigned long j, k;
  111. /* An empty child */
  112. if (inode == NULL)
  113. @@ -464,6 +516,9 @@ static int inflate(struct trie *t, struc
  114. continue;
  115. }
  116. + /* drop the node in the old tnode free list */
  117. + tnode_free_append(oldtnode, inode);
  118. +
  119. /* An internal node with two children */
  120. if (inode->bits == 1) {
  121. put_child(tn, 2 * i + 1, tnode_get_child(inode, 1));
  122. @@ -488,9 +543,9 @@ static int inflate(struct trie *t, struc
  123. node1 = tnode_new(inode->key | m, inode->pos, inode->bits - 1);
  124. if (!node1)
  125. goto nomem;
  126. - tnode_free_append(tn, node1);
  127. + node0 = tnode_new(inode->key, inode->pos, inode->bits - 1);
  128. - node0 = tnode_new(inode->key & ~m, inode->pos, inode->bits - 1);
  129. + tnode_free_append(tn, node1);
  130. if (!node0)
  131. goto nomem;
  132. tnode_free_append(tn, node0);
  133. @@ -512,53 +567,9 @@ static int inflate(struct trie *t, struc
  134. put_child(tn, 2 * i, node0);
  135. }
  136. - /* setup the parent pointer into and out of this node */
  137. - tp = node_parent(oldtnode);
  138. - NODE_INIT_PARENT(tn, tp);
  139. - put_child_root(tp, t, tn->key, tn);
  140. + /* setup the parent pointers into and out of this node */
  141. + replace(t, oldtnode, tn);
  142. - /* prepare oldtnode to be freed */
  143. - tnode_free_init(oldtnode);
  144. -
  145. - /* update all child nodes parent pointers to route to us */
  146. - for (i = tnode_child_length(oldtnode); i;) {
  147. - inode = tnode_get_child(oldtnode, --i);
  148. -
  149. - /* A leaf or an internal node with skipped bits */
  150. - if (!tnode_full(oldtnode, inode)) {
  151. - node_set_parent(inode, tn);
  152. - continue;
  153. - }
  154. -
  155. - /* drop the node in the old tnode free list */
  156. - tnode_free_append(oldtnode, inode);
  157. -
  158. - /* fetch new nodes */
  159. - node1 = tnode_get_child(tn, 2 * i + 1);
  160. - node0 = tnode_get_child(tn, 2 * i);
  161. -
  162. - /* bits == 1 then node0 and node1 represent inode's children */
  163. - if (inode->bits == 1) {
  164. - node_set_parent(node1, tn);
  165. - node_set_parent(node0, tn);
  166. - continue;
  167. - }
  168. -
  169. - /* update parent pointers in child node's children */
  170. - for (k = tnode_child_length(inode), j = k / 2; j;) {
  171. - node_set_parent(tnode_get_child(inode, --k), node1);
  172. - node_set_parent(tnode_get_child(inode, --j), node0);
  173. - node_set_parent(tnode_get_child(inode, --k), node1);
  174. - node_set_parent(tnode_get_child(inode, --j), node0);
  175. - }
  176. -
  177. - /* resize child nodes */
  178. - resize(t, node1);
  179. - resize(t, node0);
  180. - }
  181. -
  182. - /* we completed without error, prepare to free old node */
  183. - tnode_free(oldtnode);
  184. return 0;
  185. nomem:
  186. /* all pointers should be clean so we are done */
  187. @@ -568,7 +579,7 @@ nomem:
  188. static int halve(struct trie *t, struct tnode *oldtnode)
  189. {
  190. - struct tnode *tn, *tp, *inode, *node0, *node1;
  191. + struct tnode *tn;
  192. unsigned long i;
  193. pr_debug("In halve\n");
  194. @@ -577,14 +588,18 @@ static int halve(struct trie *t, struct
  195. if (!tn)
  196. return -ENOMEM;
  197. + /* prepare oldtnode to be freed */
  198. + tnode_free_init(oldtnode);
  199. +
  200. /* Assemble all of the pointers in our cluster, in this case that
  201. * represents all of the pointers out of our allocated nodes that
  202. * point to existing tnodes and the links between our allocated
  203. * nodes.
  204. */
  205. for (i = tnode_child_length(oldtnode); i;) {
  206. - node1 = tnode_get_child(oldtnode, --i);
  207. - node0 = tnode_get_child(oldtnode, --i);
  208. + struct tnode *node1 = tnode_get_child(oldtnode, --i);
  209. + struct tnode *node0 = tnode_get_child(oldtnode, --i);
  210. + struct tnode *inode;
  211. /* At least one of the children is empty */
  212. if (!node1 || !node0) {
  213. @@ -609,34 +624,8 @@ static int halve(struct trie *t, struct
  214. put_child(tn, i / 2, inode);
  215. }
  216. - /* setup the parent pointer out of and back into this node */
  217. - tp = node_parent(oldtnode);
  218. - NODE_INIT_PARENT(tn, tp);
  219. - put_child_root(tp, t, tn->key, tn);
  220. -
  221. - /* prepare oldtnode to be freed */
  222. - tnode_free_init(oldtnode);
  223. -
  224. - /* update all of the child parent pointers */
  225. - for (i = tnode_child_length(tn); i;) {
  226. - inode = tnode_get_child(tn, --i);
  227. -
  228. - /* only new tnodes will be considered "full" nodes */
  229. - if (!tnode_full(tn, inode)) {
  230. - node_set_parent(inode, tn);
  231. - continue;
  232. - }
  233. -
  234. - /* Two nonempty children */
  235. - node_set_parent(tnode_get_child(inode, 1), inode);
  236. - node_set_parent(tnode_get_child(inode, 0), inode);
  237. -
  238. - /* resize child node */
  239. - resize(t, inode);
  240. - }
  241. -
  242. - /* all pointers should be clean so we are done */
  243. - tnode_free(oldtnode);
  244. + /* setup the parent pointers into and out of this node */
  245. + replace(t, oldtnode, tn);
  246. return 0;
  247. }