Skip to content

Commit 0ddb79b

Browse files
David Ahernlizf-os
David Ahern
authored and
lizf-os
committed
net: Fix RCU splat in af_key
commit ba51b6be38c122f7dab40965b4397aaf6188a464 upstream. Hit the following splat testing VRF change for ipsec: [ 113.475692] =============================== [ 113.476194] [ INFO: suspicious RCU usage. ] [ 113.476667] 4.2.0-rc6-1+deb7u2+clUNRELEASED Quarx2k#3.2.65-1+deb7u2+clUNRELEASED Not tainted [ 113.477545] ------------------------------- [ 113.478013] /work/monster-14/dsa/kernel.git/include/linux/rcupdate.h:568 Illegal context switch in RCU read-side critical section! [ 113.479288] [ 113.479288] other info that might help us debug this: [ 113.479288] [ 113.480207] [ 113.480207] rcu_scheduler_active = 1, debug_locks = 1 [ 113.480931] 2 locks held by setkey/6829: [ 113.481371] #0: (&net->xfrm.xfrm_cfg_mutex){+.+.+.}, at: [<ffffffff814e9887>] pfkey_sendmsg+0xfb/0x213 [ 113.482509] #1: (rcu_read_lock){......}, at: [<ffffffff814e767f>] rcu_read_lock+0x0/0x6e [ 113.483509] [ 113.483509] stack backtrace: [ 113.484041] CPU: 0 PID: 6829 Comm: setkey Not tainted 4.2.0-rc6-1+deb7u2+clUNRELEASED Quarx2k#3.2.65-1+deb7u2+clUNRELEASED [ 113.485422] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5.1-0-g8936dbb-20141113_115728-nilsson.home.kraxel.org 04/01/2014 [ 113.486845] 0000000000000001 ffff88001d4c7a98 ffffffff81518af2 ffffffff81086962 [ 113.487732] ffff88001d538480 ffff88001d4c7ac8 ffffffff8107ae75 ffffffff8180a154 [ 113.488628] 0000000000000b30 0000000000000000 00000000000000d0 ffff88001d4c7ad8 [ 113.489525] Call Trace: [ 113.489813] [<ffffffff81518af2>] dump_stack+0x4c/0x65 [ 113.490389] [<ffffffff81086962>] ? console_unlock+0x3d6/0x405 [ 113.491039] [<ffffffff8107ae75>] lockdep_rcu_suspicious+0xfa/0x103 [ 113.491735] [<ffffffff81064032>] rcu_preempt_sleep_check+0x45/0x47 [ 113.492442] [<ffffffff8106404d>] ___might_sleep+0x19/0x1c8 [ 113.493077] [<ffffffff81064268>] __might_sleep+0x6c/0x82 [ 113.493681] [<ffffffff81133190>] cache_alloc_debugcheck_before.isra.50+0x1d/0x24 [ 113.494508] [<ffffffff81134876>] kmem_cache_alloc+0x31/0x18f [ 113.495149] [<ffffffff814012b5>] skb_clone+0x64/0x80 [ 113.495712] [<ffffffff814e6f71>] pfkey_broadcast_one+0x3d/0xff [ 113.496380] [<ffffffff814e7b84>] pfkey_broadcast+0xb5/0x11e [ 113.497024] [<ffffffff814e82d1>] pfkey_register+0x191/0x1b1 [ 113.497653] [<ffffffff814e9770>] pfkey_process+0x162/0x17e [ 113.498274] [<ffffffff814e9895>] pfkey_sendmsg+0x109/0x213 In pfkey_sendmsg the net mutex is taken and then pfkey_broadcast takes the RCU lock. Since pfkey_broadcast takes the RCU lock the allocation argument is pointless since GFP_ATOMIC must be used between the rcu_read_{,un}lock. The one call outside of rcu can be done with GFP_KERNEL. Fixes: 7f6b9db ("af_key: locking change") Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li <lizefan@huawei.com>
1 parent cc45692 commit 0ddb79b

1 file changed

Lines changed: 23 additions & 23 deletions

File tree

‎net/key/af_key.c‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
220220
#define BROADCAST_ONE 1
221221
#define BROADCAST_REGISTERED 2
222222
#define BROADCAST_PROMISC_ONLY 4
223-
static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
223+
static int pfkey_broadcast(struct sk_buff *skb,
224224
int broadcast_flags, struct sock *one_sk,
225225
struct net *net)
226226
{
@@ -246,7 +246,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
246246
* socket.
247247
*/
248248
if (pfk->promisc)
249-
pfkey_broadcast_one(skb, &skb2, allocation, sk);
249+
pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
250250

251251
/* the exact target will be processed later */
252252
if (sk == one_sk)
@@ -261,7 +261,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
261261
continue;
262262
}
263263

264-
err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk);
264+
err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
265265

266266
/* Error is cleare after succecful sending to at least one
267267
* registered KM */
@@ -271,7 +271,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
271271
rcu_read_unlock();
272272

273273
if (one_sk != NULL)
274-
err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
274+
err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
275275

276276
kfree_skb(skb2);
277277
kfree_skb(skb);
@@ -294,7 +294,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
294294
hdr = (struct sadb_msg *) pfk->dump.skb->data;
295295
hdr->sadb_msg_seq = 0;
296296
hdr->sadb_msg_errno = rc;
297-
pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
297+
pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
298298
&pfk->sk, sock_net(&pfk->sk));
299299
pfk->dump.skb = NULL;
300300
}
@@ -335,7 +335,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
335335
hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
336336
sizeof(uint64_t));
337337

338-
pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
338+
pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
339339

340340
return 0;
341341
}
@@ -1361,7 +1361,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
13611361

13621362
xfrm_state_put(x);
13631363

1364-
pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
1364+
pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
13651365

13661366
return 0;
13671367
}
@@ -1449,7 +1449,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
14491449
hdr->sadb_msg_seq = c->seq;
14501450
hdr->sadb_msg_pid = c->pid;
14511451

1452-
pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
1452+
pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
14531453

14541454
return 0;
14551455
}
@@ -1566,7 +1566,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
15661566
out_hdr->sadb_msg_reserved = 0;
15671567
out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
15681568
out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
1569-
pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
1569+
pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
15701570

15711571
return 0;
15721572
}
@@ -1667,7 +1667,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
16671667
return -ENOBUFS;
16681668
}
16691669

1670-
pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk, sock_net(sk));
1670+
pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
16711671

16721672
return 0;
16731673
}
@@ -1686,7 +1686,7 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
16861686
hdr->sadb_msg_errno = (uint8_t) 0;
16871687
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
16881688

1689-
return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
1689+
return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
16901690
}
16911691

16921692
static int key_notify_sa_flush(const struct km_event *c)
@@ -1707,7 +1707,7 @@ static int key_notify_sa_flush(const struct km_event *c)
17071707
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
17081708
hdr->sadb_msg_reserved = 0;
17091709

1710-
pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
1710+
pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
17111711

17121712
return 0;
17131713
}
@@ -1768,7 +1768,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
17681768
out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
17691769

17701770
if (pfk->dump.skb)
1771-
pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
1771+
pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
17721772
&pfk->sk, sock_net(&pfk->sk));
17731773
pfk->dump.skb = out_skb;
17741774

@@ -1829,7 +1829,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
18291829
new_hdr->sadb_msg_errno = 0;
18301830
}
18311831

1832-
pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
1832+
pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
18331833
return 0;
18341834
}
18351835

@@ -2160,7 +2160,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
21602160
out_hdr->sadb_msg_errno = 0;
21612161
out_hdr->sadb_msg_seq = c->seq;
21622162
out_hdr->sadb_msg_pid = c->pid;
2163-
pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
2163+
pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
21642164
return 0;
21652165

21662166
}
@@ -2386,7 +2386,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
23862386
out_hdr->sadb_msg_errno = 0;
23872387
out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
23882388
out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
2389-
pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
2389+
pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
23902390
err = 0;
23912391

23922392
out:
@@ -2639,7 +2639,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
26392639
out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
26402640

26412641
if (pfk->dump.skb)
2642-
pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
2642+
pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
26432643
&pfk->sk, sock_net(&pfk->sk));
26442644
pfk->dump.skb = out_skb;
26452645

@@ -2690,7 +2690,7 @@ static int key_notify_policy_flush(const struct km_event *c)
26902690
hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
26912691
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
26922692
hdr->sadb_msg_reserved = 0;
2693-
pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
2693+
pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
26942694
return 0;
26952695

26962696
}
@@ -2756,7 +2756,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
27562756
void *ext_hdrs[SADB_EXT_MAX];
27572757
int err;
27582758

2759-
pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
2759+
pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
27602760
BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
27612761

27622762
memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -2962,7 +2962,7 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
29622962
out_hdr->sadb_msg_seq = 0;
29632963
out_hdr->sadb_msg_pid = 0;
29642964

2965-
pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
2965+
pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
29662966
return 0;
29672967
}
29682968

@@ -3134,7 +3134,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
31343134
xfrm_ctx->ctx_len);
31353135
}
31363136

3137-
return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
3137+
return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
31383138
}
31393139

31403140
static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3332,7 +3332,7 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
33323332
n_port->sadb_x_nat_t_port_port = sport;
33333333
n_port->sadb_x_nat_t_port_reserved = 0;
33343334

3335-
return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
3335+
return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
33363336
}
33373337

33383338
#ifdef CONFIG_NET_KEY_MIGRATE
@@ -3524,7 +3524,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
35243524
}
35253525

35263526
/* broadcast migrate message to sockets */
3527-
pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
3527+
pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
35283528

35293529
return 0;
35303530

0 commit comments

Comments
 (0)