linux/net/tipc
Paolo Abeni 26736a08ee tipc: don't call sock_release() in atomic context
syzbot reported a scheduling while atomic issue at netns
destruction time:

BUG: sleeping function called from invalid context at net/core/sock.c:2769
in_atomic(): 1, irqs_disabled(): 0, pid: 85, name: kworker/u4:3
5 locks held by kworker/u4:3/85:
  :  ((wq_completion)"%s""netns"){+.+.}, at: [<00000000c9792deb>]
process_one_work+0xaaf/0x1af0 kernel/workqueue.c:2084
  :  (net_cleanup_work){+.+.}, at: [<00000000adc12e2a>]
process_one_work+0xb01/0x1af0 kernel/workqueue.c:2088
  :  (net_sem){++++}, at: [<000000009ccb5669>] cleanup_net+0x23f/0xd20
net/core/net_namespace.c:494
  :  (net_mutex){+.+.}, at: [<00000000a92767d9>] cleanup_net+0xa7d/0xd20
net/core/net_namespace.c:496
  :  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
spin_lock_bh include/linux/spinlock.h:315 [inline]
  :  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
tipc_topsrv_stop+0x231/0x610 net/tipc/topsrv.c:685
CPU: 0 PID: 85 Comm: kworker/u4:3 Not tainted 4.16.0-rc1+ 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128
  __might_sleep+0x95/0x190 kernel/sched/core.c:6081
  lock_sock_nested+0x37/0x110 net/core/sock.c:2769
  lock_sock include/net/sock.h:1463 [inline]
  tipc_release+0x103/0xff0 net/tipc/socket.c:572
  sock_release+0x8d/0x1e0 net/socket.c:594
  tipc_topsrv_stop+0x3c0/0x610 net/tipc/topsrv.c:696
  tipc_exit_net+0x15/0x40 net/tipc/core.c:96
  ops_exit_list.isra.6+0xae/0x150 net/core/net_namespace.c:148
  cleanup_net+0x6ba/0xd20 net/core/net_namespace.c:529
  process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113
  worker_thread+0x223/0x1990 kernel/workqueue.c:2247
  kthread+0x33c/0x400 kernel/kthread.c:238
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429

This is caused by tipc_topsrv_stop() releasing the listener socket
with the idr lock held. This changeset addresses the issue moving
the release operation outside such lock.

Reported-and-tested-by: syzbot+749d9d87c294c00ca856@syzkaller.appspotmail.com
Fixes: 0ef897be12 ("tipc: separate topology server listener socket from subcsriber sockets")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by:  ///jon
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-19 14:38:50 -05:00
..
addr.c tipc: simplify include dependencies 2015-05-14 12:24:45 -04:00
addr.h tipc: introduce constants for tipc address validation 2016-07-26 14:26:42 -07:00
bcast.c tipc: fall back to smaller MTU if allocation of local send skb fails 2017-12-01 15:21:25 -05:00
bcast.h tipc: make replicast a user selectable option 2017-01-20 12:10:17 -05:00
bearer.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
bearer.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-09-01 17:42:05 -07:00
core.c netns: make struct pernet_operations::id unsigned int 2016-11-18 10:59:15 -05:00
core.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
discover.c net: tipc: Convert timers to use timer_setup() 2017-11-01 12:38:45 +09:00
discover.h tipc: eliminate buffer leak in bearer layer 2016-04-07 17:00:13 -04:00
eth_media.c tipc: make media address offset a common define 2015-02-27 18:18:48 -05:00
group.c tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
group.h tipc: fix race between poll() and setsockopt() 2018-01-19 15:12:21 -05:00
ib_media.c tipc: rename media/msg related definitions 2015-02-27 18:18:48 -05:00
Kconfig tipc: add ip/udp media type 2015-03-05 22:08:42 -05:00
link.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
link.h tipc: transfer broadcast nacks in link state messages 2016-09-02 17:10:24 -07:00
Makefile tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
monitor.c tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path 2017-12-27 10:55:00 -05:00
monitor.h tipc: dump monitor attributes 2016-07-26 14:26:42 -07:00
msg.c tipc: fix skb truesize/datasize ratio control 2018-02-08 15:30:40 -05:00
msg.h tipc: fall back to smaller MTU if allocation of local send skb fails 2017-12-01 15:21:25 -05:00
name_distr.c tipc: allocate user memory with GFP_KERNEL flag 2017-01-16 13:31:53 -05:00
name_distr.h tipc: reduce code dependency between binding table and node layer 2015-11-20 14:06:10 -05:00
name_table.c tipc: make struct tipc_server private for server.c 2018-02-16 15:26:34 -05:00
name_table.h tipc: simplify endianness handling in topology subscriber 2018-02-16 15:26:33 -05:00
net.c netlink: pass extended ACK struct where available 2017-04-13 13:58:22 -04:00
net.h tipc: add peer removal functionality 2016-08-18 23:36:07 -07:00
netlink_compat.c net: tipc: constify genl_ops 2017-08-23 22:31:38 -07:00
netlink.c netlink: pass extended ACK struct to parsing functions 2017-04-13 13:58:22 -04:00
netlink.h tipc: make cluster size threshold for monitoring configurable 2016-07-26 14:26:42 -07:00
node.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
node.h tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
socket.c net: make getname() functions return length rather than use int* parameter 2018-02-12 14:15:04 -05:00
socket.h tipc: redesign connection-level flow control 2016-05-03 15:51:16 -04:00
subscr.c tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
subscr.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
sysctl.c tipc: add name distributor resiliency queue 2014-09-01 17:51:48 -07:00
topsrv.c tipc: don't call sock_release() in atomic context 2018-02-19 14:38:50 -05:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
udp_media.c tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() 2017-12-01 15:14:22 -05:00
udp_media.h tipc: add UDP remoteip dump to netlink API 2016-08-26 21:38:41 -07:00