lkml.org 
[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 55/69] sctp: fix sleep in atomic context bug in timer handlers
    Date
    From: Duoming Zhou <duoming@zju.edu.cn>

    [ Upstream commit b89fc26f741d9f9efb51cba3e9b241cf1380ec5a ]

    There are sleep in atomic context bugs in timer handlers of sctp
    such as sctp_generate_t3_rtx_event(), sctp_generate_probe_event(),
    sctp_generate_t1_init_event(), sctp_generate_timeout_event(),
    sctp_generate_t3_rtx_event() and so on.

    The root cause is sctp_sched_prio_init_sid() with GFP_KERNEL parameter
    that may sleep could be called by different timer handlers which is in
    interrupt context.

    One of the call paths that could trigger bug is shown below:

    (interrupt context)
    sctp_generate_probe_event
    sctp_do_sm
    sctp_side_effects
    sctp_cmd_interpreter
    sctp_outq_teardown
    sctp_outq_init
    sctp_sched_set_sched
    n->init_sid(..,GFP_KERNEL)
    sctp_sched_prio_init_sid //may sleep

    This patch changes gfp_t parameter of init_sid in sctp_sched_set_sched()
    from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic
    context bugs.

    Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Link: https://lore.kernel.org/r/20220723015809.11553-1-duoming@zju.edu.cn
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sctp/stream_sched.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c
    index 99e5f69fbb74..a2e1d34f52c5 100644
    --- a/net/sctp/stream_sched.c
    +++ b/net/sctp/stream_sched.c
    @@ -163,7 +163,7 @@ int sctp_sched_set_sched(struct sctp_association *asoc,
    if (!SCTP_SO(&asoc->stream, i)->ext)
    continue;

    - ret = n->init_sid(&asoc->stream, i, GFP_KERNEL);
    + ret = n->init_sid(&asoc->stream, i, GFP_ATOMIC);
    if (ret)
    goto err;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-01 14:07    [W:5.661 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site