CBQ: Destroy filters before destroying classes

Dave,

CBQ destroys its classes by traversing the hashtable and thus classes are not destroyed from root to leafs which means that class Y being a subclass of class X may be destroyed before X. This is a problem if a filter is attached to class X (parent) classifying into class Y (result). In case Y gets deleted before X the filter references an already deleted class while trying to unbind (cbq_unbind_filter). Therefore all filters must be destroyed before destroying classes. An additional BUG_TRAP has been added to document this not so obvious case.

Patch is relative to "Convert Qdiscs to use generic network statistics/estimator" patchset.

The BUG can be triggered with the following commands:
$TC qdisc add dev $DEV root handle 10:0 cbq bandwidth 100Mbit avpkt 1400 mpu 64 $TC class add dev $DEV parent 10:0 classid 10:12 cbq bandwidth 100mbit \
rate 100mbit allot 1514 prio 3 maxburst 1 avpkt 500 bounded
$TC class add dev $DEV parent 10:12 classid 10:13 cbq bandwidth 100mbit \
rate 100mbit allot 1514 prio 3 maxburst 1 avpkt 500 bounded
$TC filter add dev $DEV parent 10:12 protocol ip prio 10 u32 match ip protocol 6 0xff flowid 10:13 $TC qdisc del dev $DEV root

The deletion ordering in the above case is: 10:0 -> 10:13 -> 10:12

diff -Nru linux-2.6.9-rc3-bk6.orig/net/sched/sch_cbq.c linux-2.6.9-rc3-bk6/net/sched/sch_cbq.c
@@ -1749,6 +1749,8 @@
 {
 	struct cbq_sched_data *q = qdisc_priv(sch);
 
+	BUG_TRAP(!cl->filters);
+
 	cbq_destroy_filters(cl);
 	qdisc_destroy(cl->q);
 	qdisc_put_rtab(cl->R_tab);

@@ -1769,6 +1771,14 @@
 #ifdef CONFIG_NET_CLS_POLICE
 	q->rx_class = NULL;
 #endif
+	/*
+	 * Filters must be destroyed first because we don't destroy the
+	 * classes from root to leafs which means that filters can still
+	 * be bound to classes which have been destroyed already. --TGR '04
+	 */
+	for (h = 0; h < 16; h++)
+		for (cl = q->classes[h]; cl; cl = cl->next)
+			cbq_destroy_filters(cl);
 
 	for (h = 0; h < 16; h++) {
 		struct cbq_class *next;

Applied, thanks a lot Thomas.

BTW, that patch set forgot to handle sch_atm.c, I'm beginning to believe that I'm the only developer with this packet scheduler enabled in his test builds :-) Most people don't have it enabled because it requires CONFIG_ATM to be on.

Anyways, I fixed that up as follows.

# This is a BitKeeper generated diff -Nru style patch. #
# ChangeSet
# 2004/10/19 21:11:02-07:00 [email protected]
# [PKT_SCHED]: Fix sch_atm build.
#
# Move it over to use qstats/bstats.
#
# Signed-off-by: David S. Miller <[email protected]>
#

# net/sched/sch_atm.c
#   2004/10/19 21:10:26-07:00 [email protected] +4 -4
#   [PKT_SCHED]: Fix sch_atm build.
# 
diff -Nru a/net/sched/sch_atm.c b/net/sched/sch_atm.c
--- a/net/sched/sch_atm.c	2004-10-19 21:21:59 -07:00
+++ b/net/sched/sch_atm.c	2004-10-19 21:21:59 -07:00
@@ -449,12 +449,12 @@
 	    result == TC_POLICE_SHOT ||
 #endif
 	    (ret = flow->q->enqueue(skb,flow->q)) != 0) {
-		sch->stats.drops++;
+		sch->qstats.drops++;
 		if (flow) flow->stats.drops++;
 		return ret;
 	}
-	sch->stats.bytes += skb->len;
-	sch->stats.packets++;
+	sch->bstats.bytes += skb->len;
+	sch->bstats.packets++;
 	flow->stats.bytes += skb->len;
 	flow->stats.packets++;
 	/*
@@ -547,7 +547,7 @@
 	ret = p->link.q->ops->requeue(skb,p->link.q);
 	if (!ret) sch->q.qlen++;
 	else {
-		sch->stats.drops++;
+		sch->qstats.drops++;
 		p->link.stats.drops++;
 	}
 	return ret;

* David S. Miller <[email protected]> 2004-10-19 21:39

My apologies and thanks for fixing it. I have put it on now :-> I will submit patches to convert the class part of classful qdiscs later today.