Soft lockup in tc_classify

[Shahar Klein]

Hi All,

sorry for the spam, the first time was sent with html part and was rejected.
We observed an issue where a classifier instance next member is pointing 
back to itself, causing a CPU soft lockup.
We found it by running traffic on many udp connections and then adding a 
new flower rule using tc.

We added a quick workaround to verify it:

In tc_classify:

        for (; tp; tp = rcu_dereference_bh(tp->next)) {
                int err;
+               if (tp == tp->next)
+                     RCU_INIT_POINTER(tp->next, NULL);


We also had a print here showing tp->next is pointing to tp. With this 
workaround we are not hitting the issue anymore.
We are not sure we fully understand the mechanism here - with the rtnl 
and rcu locks.
We'll appreciate your help solving this issue.

Thanks,
Shahar