ipv4: Fix fib_trie rebalancing, part 2
My previous patch, which explicitly delays freeing of tnodes by adding
them to the list to flush them after the update is finished, isn't
strict enough. It treats exceptionally tnodes without parent, assuming
they are newly created, so "invisible" for the read side yet.
But the top tnode doesn't have parent as well, so we have to exclude
all exceptions (at least until a better way is found). Additionally we
need to move rcu assignment of this node before flushing, so the
return type of the trie_rebalance() function is changed.
Reported-by: Yan Zheng <zheng.yan@oracle.com>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index d1a39b1..012cf5a 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -391,13 +391,8 @@
static void tnode_free_safe(struct tnode *tn)
{
BUG_ON(IS_LEAF(tn));
-
- if (node_parent((struct node *) tn)) {
- tn->tnode_free = tnode_free_head;
- tnode_free_head = tn;
- } else {
- tnode_free(tn);
- }
+ tn->tnode_free = tnode_free_head;
+ tnode_free_head = tn;
}
static void tnode_free_flush(void)
@@ -1009,7 +1004,7 @@
return NULL;
}
-static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
+static void trie_rebalance(struct trie *t, struct tnode *tn)
{
int wasfull;
t_key cindex, key;
@@ -1033,12 +1028,13 @@
}
/* Handle last (top) tnode */
- if (IS_TNODE(tn)) {
+ if (IS_TNODE(tn))
tn = (struct tnode *)resize(t, (struct tnode *)tn);
- tnode_free_flush();
- }
- return (struct node *)tn;
+ rcu_assign_pointer(t->trie, (struct node *)tn);
+ tnode_free_flush();
+
+ return;
}
/* only used from updater-side */
@@ -1186,7 +1182,7 @@
/* Rebalance the trie */
- rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
+ trie_rebalance(t, tp);
done:
return fa_head;
}
@@ -1605,7 +1601,7 @@
if (tp) {
t_key cindex = tkey_extract_bits(l->key, tp->pos, tp->bits);
put_child(t, (struct tnode *)tp, cindex, NULL);
- rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
+ trie_rebalance(t, tp);
} else
rcu_assign_pointer(t->trie, NULL);