From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.41 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793334196; b=ZM0mJhn2FAvOX4aJeIHt/A2R7rnC6GSYODqWg6HiCa0m1wggGqpOIf6QHUN7xxIRa4GC 1Gj4qx+36anfB2cOwmzy19LA8VauGtNTcS02DrBzz/Eu7OX9imH8d+bLu8huhnrl4UcjO WOCCGUAZ4fDsUMh/nGu4ZCDguAKwRa/zEjT+WmASnLZsRAjy7jtRYKHN7qPAKc017PqOi SyEa9n2353AwB5H6ySddoxJ3JVx+ZhhlyMPSlQCrm5EY4sSL4XI54yNWGSNWIT5Cr+LOz HtCci3zboCdFDIhOG2GzPblja0kzP1IS7DYMArQwtC08dnASioEiGaK0H5rsZcaSDMQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793334196; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=k74rtqmStg38qqnyyU9KS/WFF7ITGPYf/taRwsmuKoU=; b=gRiMIGqJ/bnOaAyRIaQGJbBBK5XAxU1CF9M7KI1++Qdgq9myoZ7HM1y3DNqzPbGn7kxg EpZ7+WQjJ30QxOqrKzPkyScknqg+ldARzoWPGTVbUz+HL/1tJwxyQMBiAVVhE3zG9Kvb+ oSop028PlYUTRG2KP6kodlemIQ2dnxE5jolMX4B+S8iLrRXaFGqFtb74Mb3qQFh6V6mBN yXBxbmasG09Kst201KuD6UHNP1O5T7hCsf9VW/yPl7ylk/OYZBxAEu4BClyPWGYnr1VKV xOUWdvRpLm0jVbxSWYMuAc7U7xTvlZyAPACtEX4X+muzXh9VaibaqWy98cu/lT2JgvA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=openai.com; spf=pass smtp.mailfrom=openai.com; dkim=pass header.d=openai.com header.i=@openai.com header.a=rsa-sha256 header.s=google header.b=LVCKgYcy; arc=none smtp.remote-ip=209.85.210.41 Received: from mail-ot1-f41.google.com (mail-ot1-f41.google.com [209.85.210.41]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D431B606A31C for ; Fri, 30 Oct 2026 04:23:15 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org D431B606A31C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=openai.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openai.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=openai.com header.i=@openai.com header.a=rsa-sha256 header.s=google header.b=LVCKgYcy Received: by mail-ot1-f41.google.com with SMTP id 46e09a7af769-84d5e56f876so258993a34.3 for ; Thu, 29 Oct 2026 21:23:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openai.com; s=google; t=1793334195; x=1793938995; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=k74rtqmStg38qqnyyU9KS/WFF7ITGPYf/taRwsmuKoU=; b=LVCKgYcyokkMhxVeJb2MI/Xsa/p8HwrQVBp2fMPOMyT0sJzlKMXp/KCeuTMtiScOCx otCIk9VAS+dAtwIvPzPJIsQFzmWtQzvEZkESJ0lX9f/ed9tz260zkEUSwy+lT5J0vHsg S/eMvI2LIyBvMvXoX09+vPXv0EDecTKbRYfVc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793334195; x=1793938995; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=k74rtqmStg38qqnyyU9KS/WFF7ITGPYf/taRwsmuKoU=; b=I7b1qbAdkRalYkQIG6idL2kdPEhi5+5a1lMtkyaDZrxgQiwkSSw0qksWq9NjtHa6zQ ka3bQ8MuJ3rHf5jDK9DQL+B+ZSPGaiE5CD0RrVH3Ekf4Z30braeLbEvGKvfVFWOC5hA4 bmsdjzBfaPCE1iqQ67GeDm8BZbbRL8w6sPA41FpcwS8ttsBRS5RLn/YW17mZjel7dJgJ AL1K0nrHVOP0xzKFV9Hx1DK/aipBJN6w1ZOVTfEqWHGJUu/AIU4g7HVKZMrIYE4JvdiF 0wMt5isXsCVk3Yma1x57zr6YVCU4QP5Vf5Qf1RSVbRm1RSqSOs+VXJ0yjBwYCLqhx5ex OaSQ== X-Forwarded-Encrypted: i=1; AKwUvByBqrv1z7mCnRQZxmEaA4RmEsLxFvRzl5VphvPBC6nxUzCjRvxERviVBOWcWs1Yi6/IixL9rnDuIo4E8/s=@vger.kernel.org X-Gm-Message-State: AFq9FYKnRFH2ce0aF7KrokuM1OeDNr82/sNbTPicjPRwMth9m2o4UIDJ uNhPl0LQ+PYej1ssgTGxE0JgHUIxMF4X0Ndv1XcxcyfAh5ErJULlakOFOdVxBPaHSHqg7MUNIyK kZX3XsGs= X-Gm-Gg: AYBFou3mM78Cezjd+LMVtSULI5pyGNvhTc322CakfVOb1ysANfrnOWXl7HvlvRhXco8 vYBraEeCXLc5hjgQ/EAQISKJSivSzCrnTzYl0uFdul9Y1QG5LldS6FQB1aYF+NGesTDd6GUyg6F QALG8MsdJEtoqgjyxuDRdcsdGMRvs1a5GSaw0YiUrslOQM0zL1mz4GUOBgjXegiu4nDibIpcIZe rmm911fH8zqSpu/4THYApGSc6lhSPzdhFkwvbKq9dmQ3dF71/HX6FJgScdso46aWqzdOGR4dCcT OUFSZVk2tydyRj1hnqQX29Qd+KQScRkYZVRaPMpyVguYpBNpI+xA1GE1in3boMSBSCQUuL/1j8b ECX6HAkJDZCQwdYibH2mEjlPZ0Wa+gE8gIUwYFLyjRgLkWWajV9M9SSzTUTExWnxb+O78r5eYAC xi2Z/Jn8cNalbiFnkAAN5fpQLI8y1h7I9DtVs/DMHrp6cFv4HzIYSIc8eQpo5QDD/eiTSUL398o vLZsXMtVc7yfVBsFkzBKZSr0/SqDvmNe1nodPpzF9+OVOAOArrIVOJlTlDG2NUoCDAyKELwMEDY jPTRQ4RSTM9ML/oxZbpdQKVNGRMUngso/2oo2ELU75Md5/h1GWw0BRPWEb9JRDw6C1stPdP4Ear FCkVBSg1k98gEjhFtXFbnRSQKr5WJFQ== X-Received: by 2002:a05:6830:3e03:b0:821:cee2:489e with SMTP id 46e09a7af769-85d3616574amr999969a34.2.1793334194805; Thu, 29 Oct 2026 21:23:14 -0700 (PDT) Received: from com-75606.corp.openai.org ([199.47.143.5]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-85d351e77c8sm1161952a34.2.2026.10.29.21.23.13 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 29 Oct 2026 21:23:14 -0700 (PDT) From: Kyle Zeng To: netdev@vger.kernel.org Cc: Jamal Hadi Salim , Jiri Pirko , linux-kernel@vger.kernel.org, outbounddisclosures@openai.com Subject: [PATCH] net/sched: revalidate the sleeping-root lock in timers Date: Thu, 29 Oct 2026 21:23:12 -0700 Message-ID: <20261030042312.74363-1-kylebot@openai.com> X-Mailer: git-send-email 2.55.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Autonomous qdisc timers select their lock through qdisc_sleeping. dev_graft_qdisc() changes that pointer while holding the previous root's lock, but a timer may have read the old pointer before the graft and only acquire its lock afterwards. RCU keeps the old qdisc alive; it does not make that lock protect the replacement hierarchy. For example, a backlogged MQ child retained by an outstanding filter request can be detached and regrafted at the same parent. An SFQ timer that selected the interim root can then rehash its queues under that obsolete lock while tbf_graft() resets the SFQ under the current root's lock. This corrupts skb lists and SFQ slot state. Add an RCU-side helper which acquires the sleeping-root lock, checks that the root is still current, and retries if it changed. Once the check succeeds, dev_graft_qdisc() cannot replace the root until the callback releases its lock. Use it in the SFQ, RED, PIE, FQ-PIE and DualPI2 timers. Route default-qdisc attachment and scheduler shutdown through dev_graft_qdisc() as well, so live sleeping-root publications follow the same locking protocol. Signed-off-by: Kyle Zeng --- I have a reproducer for this issue and can share via DM include/net/sch_generic.h | 20 ++++++++++++++++++++ net/sched/sch_dualpi2.c | 3 +-- net/sched/sch_fq_pie.c | 3 +-- net/sched/sch_generic.c | 5 +++-- net/sched/sch_pie.c | 3 +-- net/sched/sch_red.c | 3 +-- net/sched/sch_sfq.c | 3 +-- 7 files changed, 28 insertions(+), 12 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 1acaadb3e2cf..e234256e6ae8 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -608,6 +608,26 @@ static inline spinlock_t *qdisc_root_sleeping_lock(const struct Qdisc *qdisc) return qdisc_lock(root); } +/* The caller must hold rcu_read_lock(). dev_graft_qdisc() changes the + * sleeping root under the old root's lock, so retry if it changed while + * we were waiting for that lock. + */ +static inline spinlock_t *qdisc_lock_root_sleeping(const struct Qdisc *qdisc) +{ + struct Qdisc *root; + /* Lock of the sleeping root observed under RCU. */ + spinlock_t *lock; + + for (;;) { + root = qdisc_root_sleeping(qdisc); + lock = qdisc_lock(root); + spin_lock(lock); + if (root == qdisc_root_sleeping(qdisc)) + return lock; + spin_unlock(lock); + } +} + static inline struct net_device *qdisc_dev(const struct Qdisc *qdisc) { return qdisc->dev_queue->dev; diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c index 4947def7c49e..8a74ceaab29d 100644 --- a/net/sched/sch_dualpi2.c +++ b/net/sched/sch_dualpi2.c @@ -750,8 +750,7 @@ static enum hrtimer_restart dualpi2_timer(struct hrtimer *timer) spinlock_t *root_lock; /* to lock qdisc for probability calculations */ rcu_read_lock(); - root_lock = qdisc_lock(qdisc_root_sleeping(sch)); - spin_lock(root_lock); + root_lock = qdisc_lock_root_sleeping(sch); WRITE_ONCE(q->pi2_prob, calculate_probability(sch)); hrtimer_set_expires(&q->pi2_timer, next_pi2_timeout(q)); diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c index 5982847df8f8..a1b5126db640 100644 --- a/net/sched/sch_fq_pie.c +++ b/net/sched/sch_fq_pie.c @@ -394,8 +394,7 @@ static void fq_pie_timer(struct timer_list *t) int max_cnt, i; rcu_read_lock(); - root_lock = qdisc_lock(qdisc_root_sleeping(sch)); - spin_lock(root_lock); + root_lock = qdisc_lock_root_sleeping(sch); /* Limit this expensive loop to 2048 flows per round. */ max_cnt = min_t(int, q->flows_cnt - q->flows_cursor, 2048); diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index 3e8ee4a691c3..f4ec712be18b 100644 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -1182,6 +1182,7 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, struct Qdisc *oqdisc = rtnl_dereference(dev_queue->qdisc_sleeping); spinlock_t *root_lock; + /* Pairs with qdisc_lock_root_sleeping() in asynchronous callbacks. */ root_lock = qdisc_lock(oqdisc); spin_lock_bh(root_lock); @@ -1205,8 +1206,8 @@ static void shutdown_scheduler_queue(struct net_device *dev, struct Qdisc *qdisc_default = _qdisc_default; if (qdisc) { + qdisc = dev_graft_qdisc(dev_queue, qdisc_default); rcu_assign_pointer(dev_queue->qdisc, qdisc_default); - rcu_assign_pointer(dev_queue->qdisc_sleeping, qdisc_default); qdisc_put(qdisc); } @@ -1230,7 +1231,7 @@ static void attach_one_default_qdisc(struct net_device *dev, if (!netif_is_multiqueue(dev)) qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT; - rcu_assign_pointer(dev_queue->qdisc_sleeping, qdisc); + dev_graft_qdisc(dev_queue, qdisc); } static void attach_default_qdiscs(struct net_device *dev) diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c index 3b7863ffd284..9367065db4b1 100644 --- a/net/sched/sch_pie.c +++ b/net/sched/sch_pie.c @@ -429,8 +429,7 @@ static void pie_timer(struct timer_list *t) spinlock_t *root_lock; rcu_read_lock(); - root_lock = qdisc_lock(qdisc_root_sleeping(sch)); - spin_lock(root_lock); + root_lock = qdisc_lock_root_sleeping(sch); pie_calculate_probability(&q->params, &q->vars, sch->qstats.backlog); /* reset the timer to fire after 'tupdate'. tupdate is in jiffies. */ diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c index d7598214270b..a7601b879092 100644 --- a/net/sched/sch_red.c +++ b/net/sched/sch_red.c @@ -333,8 +333,7 @@ static inline void red_adaptative_timer(struct timer_list *t) spinlock_t *root_lock; rcu_read_lock(); - root_lock = qdisc_lock(qdisc_root_sleeping(sch)); - spin_lock(root_lock); + root_lock = qdisc_lock_root_sleeping(sch); red_adaptative_algo(&q->parms, &q->vars); mod_timer(&q->adapt_timer, jiffies + HZ/2); spin_unlock(root_lock); diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c index 8bbcfc9e85d9..2bd3fc65053a 100644 --- a/net/sched/sch_sfq.c +++ b/net/sched/sch_sfq.c @@ -611,8 +611,7 @@ static void sfq_perturbation(struct timer_list *t) get_random_bytes(&nkey, sizeof(nkey)); rcu_read_lock(); - root_lock = qdisc_lock(qdisc_root_sleeping(sch)); - spin_lock(root_lock); + root_lock = qdisc_lock_root_sleeping(sch); q->perturbation = nkey; if (!q->filter_list && q->tail) sfq_rehash(sch); base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3 -- 2.56.0