net_sched: convert rsvp to call tcf_exts_destroy from rcu callback

Adjust destroy path of cls_rsvp to call tcf_exts_destroy() after
rcu grace period.

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 02fa82792dab8334d1dc14408f7ed42a4db0c141..f9c9fc075fe65402c531ada58be9e4b916d282cd 100644 (file)
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -283,12 +283,22 @@ static int rsvp_init(struct tcf_proto *tp)
        return -ENOBUFS;
 }
 
-static void
-rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
+static void rsvp_delete_filter_rcu(struct rcu_head *head)
 {
-       tcf_unbind_filter(tp, &f->res);
+       struct rsvp_filter *f = container_of(head, struct rsvp_filter, rcu);
+
        tcf_exts_destroy(&f->exts);
-       kfree_rcu(f, rcu);
+       kfree(f);
+}
+
+static void rsvp_delete_filter(struct tcf_proto *tp, struct rsvp_filter *f)
+{
+       tcf_unbind_filter(tp, &f->res);
+       /* all classifiers are required to call tcf_exts_destroy() after rcu
+        * grace period, since converted-to-rcu actions are relying on that
+        * in cleanup() callback
+        */
+       call_rcu(&f->rcu, rsvp_delete_filter_rcu);
 }
 
 static bool rsvp_destroy(struct tcf_proto *tp, bool force)