net: sched: don't do tcf_chain_flush from tcf_chain_destroy

tcf_chain_flush needs to be called with RTNL. However, on
free_tcf->
 tcf_action_goto_chain_fini->
  tcf_chain_put->
   tcf_chain_destroy->
    tcf_chain_flush
callpath, it is called without RTNL.
This issue was notified by following warning:

[  155.599052] WARNING: suspicious RCU usage
[  155.603165] 4.13.0-rc5jiri+ #54 Not tainted
[  155.607456] -----------------------------
[  155.611561] net/sched/cls_api.c:195 suspicious rcu_dereference_protected() usage!

Since on this callpath, the chain is guaranteed to be already empty
by check in tcf_chain_put, move the tcf_chain_flush call out and call it
only where it is needed - into tcf_block_put.

Fixes: db50514f9a9c ("net: sched: add termination action to allow goto chain")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 45cd34eee72701240901a250cbf2a6f071737afc..6c5ea84d2682ab81fb9755361fa77326fa9d9935 100644 (file)
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -219,8 +219,6 @@ static void tcf_chain_destroy(struct tcf_chain *chain)
        if (!list_empty(&chain->list))
                list_del_init(&chain->list);
 
-       tcf_chain_flush(chain);
-
        /* There might still be a reference held when we got here from
         * tcf_block_put. Wait for the user to drop reference before free.
         */
@@ -296,8 +294,10 @@ void tcf_block_put(struct tcf_block *block)
        if (!block)
                return;
 
-       list_for_each_entry_safe(chain, tmp, &block->chain_list, list)
+       list_for_each_entry_safe(chain, tmp, &block->chain_list, list) {
+               tcf_chain_flush(chain);
                tcf_chain_destroy(chain);
+       }
        kfree(block);
 }
 EXPORT_SYMBOL(tcf_block_put);