lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 16 Sep 2020 19:00:20 -0700
From: (Francesco Ruggeri)
Subject: [PATCH] net: make netdev_wait_allrefs wake-able

The combination of aca_free_rcu, introduced in commit 2384d02520ff
("net/ipv6: Add anycast addresses to a global hashtable"), and
fib6_info_destroy_rcu, introduced in commit 9b0a8da8c4c6 ("net/ipv6:
respect rcu grace period before freeing fib6_info"), can result in
an extra rcu grace period being needed when deleting an interface,
with the result that netdev_wait_allrefs ends up hitting the msleep(250),
which is considerably longer than the required grace period.
This can result in long delays when deleting a large number of interfaces,
and it can be observed with this script:


ip netns add $ns
ip netns exec $ns ip link set lo up
ip netns exec $ns sysctl net.ipv6.conf.default.disable_ipv6=0
ip netns exec $ns sysctl net.ipv6.conf.default.forwarding=1

for ((i=0; i<$NIFS; i++))
        ip netns exec $ns ip link add $if type dummy
        ip netns exec $ns ip link set $if up
        ip netns exec $ns ip -6 addr add 2021:$i::1/120 dev $if

for ((i=0; i<$NIFS; i++))
        ip netns exec $ns ip link del $if

ip netns del $ns

This patch converts the msleep(250) into a wake-able wait,
allowing dev_put to wake up netdev_wait_allrefs.

Time with this patch on a 5.4 kernel:

real	0m7.494s
user	0m0.403s
sys	0m1.197s

Time without this patch:

real	0m31.522s
user	0m0.438s
sys	0m1.156s

Signed-off-by: Francesco Ruggeri <>

 include/linux/netdevice.h | 6 ++++++
 net/core/dev.c            | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b0e303f6603f..3bbae238c11d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1795,6 +1795,7 @@ enum netdev_priv_flags {
  *	@needs_free_netdev:	Should unregister perform free_netdev?
  *	@priv_destructor:	Called from unregister
+ *	@destroy_task:		Task waiting for refcount to drop to 0
  *	@npinfo:		XXX: need comments on this one
  * 	@nd_net:		Network namespace this network device is inside
@@ -2089,6 +2090,7 @@ struct net_device {
 	bool needs_free_netdev;
 	void (*priv_destructor)(struct net_device *dev);
+	struct task_struct	*destroy_task;
 	struct netpoll_info __rcu	*npinfo;
@@ -3873,7 +3875,11 @@ void netdev_run_todo(void);
 static inline void dev_put(struct net_device *dev)
+	struct task_struct *destroy_task = dev->destroy_task;
+	if (destroy_task)
+		wake_up_process(destroy_task);
diff --git a/net/core/dev.c b/net/core/dev.c
index 4086d335978c..795c3d39e807 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -9994,6 +9994,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
 	rebroadcast_time = warning_time = jiffies;
+	dev->destroy_task = current;
 	refcnt = netdev_refcnt_read(dev);
 	while (refcnt != 0) {
@@ -10023,7 +10024,8 @@ static void netdev_wait_allrefs(struct net_device *dev)
 			rebroadcast_time = jiffies;
-		msleep(250);
+		set_current_state(TASK_UNINTERRUPTIBLE);
+		schedule_timeout(HZ/4);
 		refcnt = netdev_refcnt_read(dev);
@@ -10033,6 +10035,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
 			warning_time = jiffies;
+	dev->destroy_task = NULL;
 /* The sequence is:

Powered by blists - more mailing lists