lkml.org 
[lkml]   [2021]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 033/120] rxrpc: Fix deadlock around release of dst cached on udp tunnel
    Date
    From: David Howells <dhowells@redhat.com>

    [ Upstream commit 5399d52233c47905bbf97dcbaa2d7a9cc31670ba ]

    AF_RXRPC sockets use UDP ports in encap mode. This causes socket and dst
    from an incoming packet to get stolen and attached to the UDP socket from
    whence it is leaked when that socket is closed.

    When a network namespace is removed, the wait for dst records to be cleaned
    up happens before the cleanup of the rxrpc and UDP socket, meaning that the
    wait never finishes.

    Fix this by moving the rxrpc (and, by dependence, the afs) private
    per-network namespace registrations to the device group rather than subsys
    group. This allows cached rxrpc local endpoints to be cleared and their
    UDP sockets closed before we try waiting for the dst records.

    The symptom is that lines looking like the following:

    unregister_netdevice: waiting for lo to become free

    get emitted at regular intervals after running something like the
    referenced syzbot test.

    Thanks to Vadim for tracking this down and work out the fix.

    Reported-by: syzbot+df400f2f24a1677cd7e0@syzkaller.appspotmail.com
    Reported-by: Vadim Fedorenko <vfedorenko@novek.ru>
    Fixes: 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook")
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: Vadim Fedorenko <vfedorenko@novek.ru>
    Link: https://lore.kernel.org/r/161196443016.3868642.5577440140646403533.stgit@warthog.procyon.org.uk
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/afs/main.c | 6 +++---
    net/rxrpc/af_rxrpc.c | 6 +++---
    2 files changed, 6 insertions(+), 6 deletions(-)

    diff --git a/fs/afs/main.c b/fs/afs/main.c
    index accdd8970e7c0..b2975256dadbd 100644
    --- a/fs/afs/main.c
    +++ b/fs/afs/main.c
    @@ -193,7 +193,7 @@ static int __init afs_init(void)
    goto error_cache;
    #endif

    - ret = register_pernet_subsys(&afs_net_ops);
    + ret = register_pernet_device(&afs_net_ops);
    if (ret < 0)
    goto error_net;

    @@ -213,7 +213,7 @@ static int __init afs_init(void)
    error_proc:
    afs_fs_exit();
    error_fs:
    - unregister_pernet_subsys(&afs_net_ops);
    + unregister_pernet_device(&afs_net_ops);
    error_net:
    #ifdef CONFIG_AFS_FSCACHE
    fscache_unregister_netfs(&afs_cache_netfs);
    @@ -244,7 +244,7 @@ static void __exit afs_exit(void)

    proc_remove(afs_proc_symlink);
    afs_fs_exit();
    - unregister_pernet_subsys(&afs_net_ops);
    + unregister_pernet_device(&afs_net_ops);
    #ifdef CONFIG_AFS_FSCACHE
    fscache_unregister_netfs(&afs_cache_netfs);
    #endif
    diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
    index 0a2f4817ec6cf..41671af6b33f9 100644
    --- a/net/rxrpc/af_rxrpc.c
    +++ b/net/rxrpc/af_rxrpc.c
    @@ -990,7 +990,7 @@ static int __init af_rxrpc_init(void)
    goto error_security;
    }

    - ret = register_pernet_subsys(&rxrpc_net_ops);
    + ret = register_pernet_device(&rxrpc_net_ops);
    if (ret)
    goto error_pernet;

    @@ -1035,7 +1035,7 @@ error_key_type:
    error_sock:
    proto_unregister(&rxrpc_proto);
    error_proto:
    - unregister_pernet_subsys(&rxrpc_net_ops);
    + unregister_pernet_device(&rxrpc_net_ops);
    error_pernet:
    rxrpc_exit_security();
    error_security:
    @@ -1057,7 +1057,7 @@ static void __exit af_rxrpc_exit(void)
    unregister_key_type(&key_type_rxrpc);
    sock_unregister(PF_RXRPC);
    proto_unregister(&rxrpc_proto);
    - unregister_pernet_subsys(&rxrpc_net_ops);
    + unregister_pernet_device(&rxrpc_net_ops);
    ASSERTCMP(atomic_read(&rxrpc_n_tx_skbs), ==, 0);
    ASSERTCMP(atomic_read(&rxrpc_n_rx_skbs), ==, 0);

    --
    2.27.0


    \
     
     \ /
      Last update: 2021-02-08 18:15    [W:11.298 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site