From: Zhu Yanjun <yanjun.zhu@linux•dev>
To: allison.henderson@oracle•com, netdev@vger•kernel.org
Cc: rds-devel@oss•oracle.com, linux-rdma@vger•kernel.org,
pabeni@redhat•com, kuba@kernel•org, edumazet@google•com,
davem@davemloft•net, santosh.shilimkar@oracle•com
Subject: Re: [PATCH v3 1/1] net:rds: Fix possible deadlock in rds_message_put
Date: Thu, 8 Feb 2024 15:37:18 +0800 [thread overview]
Message-ID: <c2ff1709-2e4a-4844-af86-216ae678be0b@linux.dev> (raw)
In-Reply-To: <20240207233856.161916-1-allison.henderson@oracle.com>
在 2024/2/8 7:38, allison.henderson@oracle•com 写道:
> From: Allison Henderson <allison.henderson@oracle•com>
>
> Functions rds_still_queued and rds_clear_recv_queue lock a given socket
> in order to safely iterate over the incoming rds messages. However
> calling rds_inc_put while under this lock creates a potential deadlock.
> rds_inc_put may eventually call rds_message_purge, which will lock
> m_rs_lock. This is the incorrect locking order since m_rs_lock is
> meant to be locked before the socket. To fix this, we move the message
> item to a local list or variable that wont need rs_recv_lock protection.
> Then we can safely call rds_inc_put on any item stored locally after
> rs_recv_lock is released.
>
> Fixes: bdbe6fbc6a2f (RDS: recv.c)
A trivial problem,
Based on the file
https://www.kernel.org/doc/Documentation/process/submitting-patches.rst,
Fixes tag should be the following?
Fixes: bdbe6fbc6a2f ("RDS: recv.c")
Thanks,
Zhu Yanjun
> Reported-by: syzbot+f9db6ff27b9bfdcfeca0@syzkaller•appspotmail.com
> Reported-by: syzbot+dcd73ff9291e6d34b3ab@syzkaller•appspotmail.com
>
> Signed-off-by: Allison Henderson <allison.henderson@oracle•com>
> ---
> net/rds/recv.c | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/net/rds/recv.c b/net/rds/recv.c
> index c71b923764fd..5627f80013f8 100644
> --- a/net/rds/recv.c
> +++ b/net/rds/recv.c
> @@ -425,6 +425,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
> struct sock *sk = rds_rs_to_sk(rs);
> int ret = 0;
> unsigned long flags;
> + struct rds_incoming *to_drop = NULL;
>
> write_lock_irqsave(&rs->rs_recv_lock, flags);
> if (!list_empty(&inc->i_item)) {
> @@ -435,11 +436,14 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
> -be32_to_cpu(inc->i_hdr.h_len),
> inc->i_hdr.h_dport);
> list_del_init(&inc->i_item);
> - rds_inc_put(inc);
> + to_drop = inc;
> }
> }
> write_unlock_irqrestore(&rs->rs_recv_lock, flags);
>
> + if (to_drop)
> + rds_inc_put(to_drop);
> +
> rdsdebug("inc %p rs %p still %d dropped %d\n", inc, rs, ret, drop);
> return ret;
> }
> @@ -758,16 +762,21 @@ void rds_clear_recv_queue(struct rds_sock *rs)
> struct sock *sk = rds_rs_to_sk(rs);
> struct rds_incoming *inc, *tmp;
> unsigned long flags;
> + LIST_HEAD(to_drop);
>
> write_lock_irqsave(&rs->rs_recv_lock, flags);
> list_for_each_entry_safe(inc, tmp, &rs->rs_recv_queue, i_item) {
> rds_recv_rcvbuf_delta(rs, sk, inc->i_conn->c_lcong,
> -be32_to_cpu(inc->i_hdr.h_len),
> inc->i_hdr.h_dport);
> + list_move(&inc->i_item, &to_drop);
> + }
> + write_unlock_irqrestore(&rs->rs_recv_lock, flags);
> +
> + list_for_each_entry_safe(inc, tmp, &to_drop, i_item) {
> list_del_init(&inc->i_item);
> rds_inc_put(inc);
> }
> - write_unlock_irqrestore(&rs->rs_recv_lock, flags);
> }
>
> /*
next prev parent reply other threads:[~2024-02-08 7:37 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-07 23:38 [PATCH v3 1/1] net:rds: Fix possible deadlock in rds_message_put allison.henderson
2024-02-08 7:37 ` Zhu Yanjun [this message]
2024-02-08 17:03 ` Allison Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c2ff1709-2e4a-4844-af86-216ae678be0b@linux.dev \
--to=yanjun.zhu@linux$(echo .)dev \
--cc=allison.henderson@oracle$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=linux-rdma@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=rds-devel@oss$(echo .)oracle.com \
--cc=santosh.shilimkar@oracle$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox