Skip to content

Commit d594a51

Browse files
Kalpan Janiintel-lab-lkp
authored andcommitted
mptcp: fix lockdep splat by using GFP_ATOMIC in sk_net_refcnt_upgrade
The function sk_net_refcnt_upgrade() is called while holding a socket lock in mptcp_subflow_create_socket(). This function performs an allocation via ref_tracker_alloc(gfp), which was using GFP_KERNEL. GFP_KERNEL can trigger page reclaim, which creates a lockdep edge with fs_reclaim, leading to a circular dependency when combined with other lock chains from the block layer (nbd driver). Change the allocation to use GFP_ATOMIC instead. This is safe because: - The ref_tracker struct is small (~200 bytes) - GFP_ATOMIC allocation failure is extremely unlikely - GFP_ATOMIC is commonly used in other locked contexts Tested with mptcp/mptcp-upstream-virtme-docker CI: all 24 tests pass. Circular dependency chain detected: fs_reclaim --> sk_lock-AF_INET --> k-sk_lock-AF_INET/1 Fixes: 0cafd77 ("net: add a refcount tracker for kernel sockets") Reported-by: syzbot+fb2c3fa2ba28aec94627@syzkaller.appspotmail.com Closes: multipath-tcp/mptcp_net-next#599 Signed-off-by: Kalpan Jani <kalpan.jani@mpiricsoftware.com>
1 parent 7fbe018 commit d594a51

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

net/core/sock.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2399,7 +2399,7 @@ void sk_net_refcnt_upgrade(struct sock *sk)
23992399
__netns_tracker_free(net, &sk->ns_tracker, false);
24002400
net_passive_dec(net);
24012401
sk->sk_net_refcnt = 1;
2402-
get_net_track(net, &sk->ns_tracker, GFP_KERNEL);
2402+
get_net_track(net, &sk->ns_tracker, GFP_ATOMIC);
24032403
sock_inuse_add(net, 1);
24042404
}
24052405
EXPORT_SYMBOL_GPL(sk_net_refcnt_upgrade);

0 commit comments

Comments
 (0)