Action API was changed to work with actions and action_idr in concurrency safe manner, however tcf_del_walker() still uses actions without taking reference to them first and deletes them directly, disregarding possible concurrent delete.
Change tcf_del_walker() to use tcf_idr_delete_index() that doesn't require caller to hold reference to action and accepts action id as argument, instead of direct action pointer. Modify tcf_action_delete_index() to return ACT_P_DELETED instead of 0 when action was deleted successfully. This is necessary to allow tcf_del_walker() to count deleted actions. Signed-off-by: Vlad Buslov <vla...@mellanox.com> --- net/sched/act_api.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 398c752ff529..d593114e7d2f 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -246,6 +246,8 @@ static int tcf_dump_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, goto done; } +static int tcf_idr_delete_index(struct tcf_idrinfo *idrinfo, u32 index); + static int tcf_del_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, const struct tc_action_ops *ops) { @@ -263,13 +265,11 @@ static int tcf_del_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, goto nla_put_failure; idr_for_each_entry_ul(idr, p, id) { - ret = __tcf_idr_release(p, false, true); - if (ret == ACT_P_DELETED) { - module_put(ops->owner); + ret = tcf_idr_delete_index(idrinfo, id); + if (ret == ACT_P_DELETED) n_i++; - } else if (ret < 0) { + else if (ret < 0) goto nla_put_failure; - } } if (nla_put_u32(skb, TCA_FCNT, n_i)) goto nla_put_failure; @@ -343,7 +343,7 @@ static int tcf_idr_delete_index(struct tcf_idrinfo *idrinfo, u32 index) tcf_action_cleanup(p); module_put(owner); - return 0; + return ACT_P_DELETED; } ret = 0; } else { -- 2.7.5