From: Cong Wang <redacted>
Date: Thu, 21 Dec 2017 16:03:30 -0800
__skb_array_empty() is only safe if array is never resized.
pfifo_fast_dequeue() is called in TX BH context and without
qdisc lock, so even after we disable BH on ->reset() path
we can still race with other CPU's.
Fixes: c5ad119fb6c0 ("net: sched: pfifo_fast use skb_array")
Reported-by: Jakub Kicinski <redacted>
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Cong Wang <redacted>
Based upon the discussion over this patch, this bug is ultimately fixed
by John's patch which adds a dummy element at the end of allocated
ptr_ring queues.
And I've just applied that.