Skip to content

Commit

Permalink
net/mlx5e: Prevent encap offload when neigh update is running
Browse files Browse the repository at this point in the history 
The cited commit adds a compeletion to remove dependency on rtnl
lock. But it causes a deadlock for multiple encapsulations:

 crash> bt ffff8aece8a64000
 PID: 1514557  TASK: ffff8aece8a64000  CPU: 3    COMMAND: "tc"
  #0 [ffffa6d14183f368] __schedule at ffffffffb8ba7f45
  msm8916-mainline#1 [ffffa6d14183f3f8] schedule at ffffffffb8ba8418
  msm8916-mainline#2 [ffffa6d14183f418] schedule_preempt_disabled at ffffffffb8ba8898
  msm8916-mainline#3 [ffffa6d14183f428] __mutex_lock at ffffffffb8baa7f8
  msm8916-mainline#4 [ffffa6d14183f4d0] mutex_lock_nested at ffffffffb8baabeb
  msm8916-mainline#5 [ffffa6d14183f4e0] mlx5e_attach_encap at ffffffffc0f48c17 [mlx5_core]
  msm8916-mainline#6 [ffffa6d14183f628] mlx5e_tc_add_fdb_flow at ffffffffc0f39680 [mlx5_core]
  msm8916-mainline#7 [ffffa6d14183f688] __mlx5e_add_fdb_flow at ffffffffc0f3b636 [mlx5_core]
  msm8916-mainline#8 [ffffa6d14183f6f0] mlx5e_tc_add_flow at ffffffffc0f3bcdf [mlx5_core]
  msm8916-mainline#9 [ffffa6d14183f728] mlx5e_configure_flower at ffffffffc0f3c1d1 [mlx5_core]
 msm8916-mainline#10 [ffffa6d14183f790] mlx5e_rep_setup_tc_cls_flower at ffffffffc0f3d529 [mlx5_core]
 msm8916-mainline#11 [ffffa6d14183f7a0] mlx5e_rep_setup_tc_cb at ffffffffc0f3d714 [mlx5_core]
 msm8916-mainline#12 [ffffa6d14183f7b0] tc_setup_cb_add at ffffffffb8931bb8
 msm8916-mainline#13 [ffffa6d14183f810] fl_hw_replace_filter at ffffffffc0dae901 [cls_flower]
 msm8916-mainline#14 [ffffa6d14183f8d8] fl_change at ffffffffc0db5c57 [cls_flower]
 msm8916-mainline#15 [ffffa6d14183f970] tc_new_tfilter at ffffffffb8936047
 msm8916-mainline#16 [ffffa6d14183fac8] rtnetlink_rcv_msg at ffffffffb88c7c31
 msm8916-mainline#17 [ffffa6d14183fb50] netlink_rcv_skb at ffffffffb8942853
 msm8916-mainline#18 [ffffa6d14183fbc0] rtnetlink_rcv at ffffffffb88c1835
 msm8916-mainline#19 [ffffa6d14183fbd0] netlink_unicast at ffffffffb8941f27
 msm8916-mainline#20 [ffffa6d14183fc18] netlink_sendmsg at ffffffffb8942245
 msm8916-mainline#21 [ffffa6d14183fc98] sock_sendmsg at ffffffffb887d482
 msm8916-mainline#22 [ffffa6d14183fcb8] ____sys_sendmsg at ffffffffb887d81a
 msm8916-mainline#23 [ffffa6d14183fd38] ___sys_sendmsg at ffffffffb88806e2
 msm8916-mainline#24 [ffffa6d14183fe90] __sys_sendmsg at ffffffffb88807a2
 msm8916-mainline#25 [ffffa6d14183ff28] __x64_sys_sendmsg at ffffffffb888080f
 msm8916-mainline#26 [ffffa6d14183ff38] do_syscall_64 at ffffffffb8b9b6a8
 msm8916-mainline#27 [ffffa6d14183ff50] entry_SYSCALL_64_after_hwframe at ffffffffb8c0007c
 crash> bt 0xffff8aeb07544000
 PID: 1110766  TASK: ffff8aeb07544000  CPU: 0    COMMAND: "kworker/u20:9"
  #0 [ffffa6d14e6b7bd8] __schedule at ffffffffb8ba7f45
  msm8916-mainline#1 [ffffa6d14e6b7c68] schedule at ffffffffb8ba8418
  msm8916-mainline#2 [ffffa6d14e6b7c88] schedule_timeout at ffffffffb8baef88
  msm8916-mainline#3 [ffffa6d14e6b7d10] wait_for_completion at ffffffffb8ba968b
  msm8916-mainline#4 [ffffa6d14e6b7d60] mlx5e_take_all_encap_flows at ffffffffc0f47ec4 [mlx5_core]
  msm8916-mainline#5 [ffffa6d14e6b7da0] mlx5e_rep_update_flows at ffffffffc0f3e734 [mlx5_core]
  msm8916-mainline#6 [ffffa6d14e6b7df8] mlx5e_rep_neigh_update at ffffffffc0f400bb [mlx5_core]
  msm8916-mainline#7 [ffffa6d14e6b7e50] process_one_work at ffffffffb80acc9c
  msm8916-mainline#8 [ffffa6d14e6b7ed0] worker_thread at ffffffffb80ad012
  msm8916-mainline#9 [ffffa6d14e6b7f10] kthread at ffffffffb80b615d
 msm8916-mainline#10 [ffffa6d14e6b7f50] ret_from_fork at ffffffffb8001b2f

After the first encap is attached, flow will be added to encap
entry's flows list. If neigh update is running at this time, the
following encaps of the flow can't hold the encap_tbl_lock and
sleep. If neigh update thread is waiting for that flow's init_done,
deadlock happens.

Fix it by holding lock outside of the for loop. If neigh update is
running, prevent encap flows from offloading. Since the lock is held
outside of the for loop, concurrent creation of encap entries is not
allowed. So remove unnecessary wait_for_completion call for res_ready.

Fixes: 95435ad ("net/mlx5e: Only access fully initialized flows in neigh update")
Signed-off-by: Chris Mi <[email protected]>
Reviewed-by: Roi Dayan <[email protected]>
Reviewed-by: Vlad Buslov <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
  • Loading branch information
Chris Mi authored and Saeed Mahameed committed May 25, 2023
1 parent e2ab5aa commit 37c3b9f
Showing 1 changed file with 20 additions and 17 deletions.
37 changes: 20 additions & 17 deletions drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -492,6 +492,19 @@ void mlx5e_encap_put(struct mlx5e_priv *priv, struct mlx5e_encap_entry *e)
mlx5e_encap_dealloc(priv, e);
}

static void mlx5e_encap_put_locked(struct mlx5e_priv *priv, struct mlx5e_encap_entry *e)
{
struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;

lockdep_assert_held(&esw->offloads.encap_tbl_lock);

if (!refcount_dec_and_test(&e->refcnt))
return;
list_del(&e->route_list);
hash_del_rcu(&e->encap_hlist);
mlx5e_encap_dealloc(priv, e);
}

static void mlx5e_decap_put(struct mlx5e_priv *priv, struct mlx5e_decap_entry *d)
{
struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
Expand Down Expand Up @@ -816,6 +829,8 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
uintptr_t hash_key;
int err = 0;

lockdep_assert_held(&esw->offloads.encap_tbl_lock);

parse_attr = attr->parse_attr;
tun_info = parse_attr->tun_info[out_index];
mpls_info = &parse_attr->mpls_info[out_index];
Expand All @@ -829,7 +844,6 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,

hash_key = hash_encap_info(&key);

mutex_lock(&esw->offloads.encap_tbl_lock);
e = mlx5e_encap_get(priv, &key, hash_key);

/* must verify if encap is valid or not */
Expand All @@ -840,15 +854,6 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
goto out_err;
}

mutex_unlock(&esw->offloads.encap_tbl_lock);
wait_for_completion(&e->res_ready);

/* Protect against concurrent neigh update. */
mutex_lock(&esw->offloads.encap_tbl_lock);
if (e->compl_result < 0) {
err = -EREMOTEIO;
goto out_err;
}
goto attach_flow;
}

Expand Down Expand Up @@ -877,15 +882,12 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
INIT_LIST_HEAD(&e->flows);
hash_add_rcu(esw->offloads.encap_tbl, &e->encap_hlist, hash_key);
tbl_time_before = mlx5e_route_tbl_get_last_update(priv);
mutex_unlock(&esw->offloads.encap_tbl_lock);

if (family == AF_INET)
err = mlx5e_tc_tun_create_header_ipv4(priv, mirred_dev, e);
else if (family == AF_INET6)
err = mlx5e_tc_tun_create_header_ipv6(priv, mirred_dev, e);

/* Protect against concurrent neigh update. */
mutex_lock(&esw->offloads.encap_tbl_lock);
complete_all(&e->res_ready);
if (err) {
e->compl_result = err;
Expand Down Expand Up @@ -920,18 +922,15 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
} else {
flow_flag_set(flow, SLOW);
}
mutex_unlock(&esw->offloads.encap_tbl_lock);

return err;

out_err:
mutex_unlock(&esw->offloads.encap_tbl_lock);
if (e)
mlx5e_encap_put(priv, e);
mlx5e_encap_put_locked(priv, e);
return err;

out_err_init:
mutex_unlock(&esw->offloads.encap_tbl_lock);
kfree(tun_info);
kfree(e);
return err;
Expand Down Expand Up @@ -1027,6 +1026,7 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
struct net_device *encap_dev = NULL;
struct mlx5e_rep_priv *rpriv;
struct mlx5e_priv *out_priv;
struct mlx5_eswitch *esw;
int out_index;
int err = 0;

Expand All @@ -1037,6 +1037,8 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
esw_attr = attr->esw_attr;
*vf_tun = false;

esw = priv->mdev->priv.eswitch;
mutex_lock(&esw->offloads.encap_tbl_lock);
for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
struct net_device *out_dev;
int mirred_ifindex;
Expand Down Expand Up @@ -1075,6 +1077,7 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
}

out:
mutex_unlock(&esw->offloads.encap_tbl_lock);
return err;
}

Expand Down

0 comments on commit 37c3b9f

Please sign in to comment.