Re: [PATCH] net: sched: fix infinite loop when trying to create tcf rule

On Wed, 13 Oct 2021 23:09:59 +0200 Paul Menzel wrote:

From: Serhiy Boiko <redacted>

After running a specific set of commands tc will become unresponsive:

    $ ip link add dev DEV type veth
    $ tc qdisc add dev DEV clsact
    $ tc chain add dev DEV chain 0 ingress
    $ tc filter del dev DEV ingress
    $ tc filter add dev DEV ingress flower action pass

When executing chain flush the chain->flushing field is set to true, which
prevents insertion of new classifier instances.  It is unset in one place
under two conditions: `refcnt - chain->action_refcnt == 0` and `!by_act`.
Ignoring the by_act and action_refcnt arguments the `flushing procedure`
will be over when refcnt is 0.

But if the chain is explicitly created (e.g. `tc chain add .. chain 0 ..`)
refcnt is set to 1 without any classifier instances. Thus the condition is
never met and the chain->flushing field is never cleared.  And because the
default chain is `flushing` new classifiers cannot be added. tc_new_tfilter
is stuck in a loop trying to find a chain where chain->flushing is false.

Moving `chain->flushing = false` from __tcf_chain_put to the end of
tcf_chain_flush will avoid the condition and the field will always be reset
after the flush procedure.

Signed-off-by: Serhiy Boiko <redacted>
[Upstreamed from https://github.com/dentproject/dentOS/commit/3480aceaa5244a11edfe1fda90afd92b0199ef23]
Signed-off-by: Paul Menzel <redacted>

This had already been submitted:

https://lore.kernel.org/all/1633848948-11315-1-git-send-email-volodymyr.mytnyk@plvision.eu/ (local)