linux/net/tipc
Paolo Abeni 26736a08ee tipc: don't call sock_release() in atomic context
syzbot reported a scheduling while atomic issue at netns
destruction time:

BUG: sleeping function called from invalid context at net/core/sock.c:2769
in_atomic(): 1, irqs_disabled(): 0, pid: 85, name: kworker/u4:3
5 locks held by kworker/u4:3/85:
  :  ((wq_completion)"%s""netns"){+.+.}, at: [<00000000c9792deb>]
process_one_work+0xaaf/0x1af0 kernel/workqueue.c:2084
  :  (net_cleanup_work){+.+.}, at: [<00000000adc12e2a>]
process_one_work+0xb01/0x1af0 kernel/workqueue.c:2088
  :  (net_sem){++++}, at: [<000000009ccb5669>] cleanup_net+0x23f/0xd20
net/core/net_namespace.c:494
  :  (net_mutex){+.+.}, at: [<00000000a92767d9>] cleanup_net+0xa7d/0xd20
net/core/net_namespace.c:496
  :  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
spin_lock_bh include/linux/spinlock.h:315 [inline]
  :  (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>]
tipc_topsrv_stop+0x231/0x610 net/tipc/topsrv.c:685
CPU: 0 PID: 85 Comm: kworker/u4:3 Not tainted 4.16.0-rc1+ 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
  __dump_stack lib/dump_stack.c:17 [inline]
  dump_stack+0x194/0x257 lib/dump_stack.c:53
  ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128
  __might_sleep+0x95/0x190 kernel/sched/core.c:6081
  lock_sock_nested+0x37/0x110 net/core/sock.c:2769
  lock_sock include/net/sock.h:1463 [inline]
  tipc_release+0x103/0xff0 net/tipc/socket.c:572
  sock_release+0x8d/0x1e0 net/socket.c:594
  tipc_topsrv_stop+0x3c0/0x610 net/tipc/topsrv.c:696
  tipc_exit_net+0x15/0x40 net/tipc/core.c:96
  ops_exit_list.isra.6+0xae/0x150 net/core/net_namespace.c:148
  cleanup_net+0x6ba/0xd20 net/core/net_namespace.c:529
  process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113
  worker_thread+0x223/0x1990 kernel/workqueue.c:2247
  kthread+0x33c/0x400 kernel/kthread.c:238
  ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429

This is caused by tipc_topsrv_stop() releasing the listener socket
with the idr lock held. This changeset addresses the issue moving
the release operation outside such lock.

Reported-and-tested-by: syzbot+749d9d87c294c00ca856@syzkaller.appspotmail.com
Fixes: 0ef897be12 ("tipc: separate topology server listener socket from subcsriber sockets")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by:  ///jon
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-19 14:38:50 -05:00
..
addr.c
addr.h
bcast.c tipc: fall back to smaller MTU if allocation of local send skb fails 2017-12-01 15:21:25 -05:00
bcast.h
bearer.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
bearer.h
core.c
core.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
discover.c net: tipc: Convert timers to use timer_setup() 2017-11-01 12:38:45 +09:00
discover.h
eth_media.c
group.c tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
group.h tipc: fix race between poll() and setsockopt() 2018-01-19 15:12:21 -05:00
ib_media.c
Kconfig
link.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
link.h
Makefile tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
monitor.c tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path 2017-12-27 10:55:00 -05:00
monitor.h
msg.c tipc: fix skb truesize/datasize ratio control 2018-02-08 15:30:40 -05:00
msg.h tipc: fall back to smaller MTU if allocation of local send skb fails 2017-12-01 15:21:25 -05:00
name_distr.c
name_distr.h
name_table.c tipc: make struct tipc_server private for server.c 2018-02-16 15:26:34 -05:00
name_table.h tipc: simplify endianness handling in topology subscriber 2018-02-16 15:26:33 -05:00
net.c
net.h
netlink_compat.c
netlink.c
netlink.h
node.c tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
node.h tipc: apply bearer link tolerance on running links 2018-02-14 15:22:24 -05:00
socket.c net: make getname() functions return length rather than use int* parameter 2018-02-12 14:15:04 -05:00
socket.h
subscr.c tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
subscr.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
sysctl.c
topsrv.c tipc: don't call sock_release() in atomic context 2018-02-19 14:38:50 -05:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
udp_media.c tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() 2017-12-01 15:14:22 -05:00
udp_media.h