linux-stable/net/rxrpc
David Howells 963485d436 rxrpc: Fix call RCU cleanup using non-bh-safe locks
rxrpc_rcu_destroy_call(), which is called as an RCU callback to clean up a
put call, calls rxrpc_put_connection() which, deep in its bowels, takes a
number of spinlocks in a non-BH-safe way, including rxrpc_conn_id_lock and
local->client_conns_lock.  RCU callbacks, however, are normally called from
softirq context, which can cause lockdep to notice the locking
inconsistency.

To get lockdep to detect this, it's necessary to have the connection
cleaned up on the put at the end of the last of its calls, though normally
the clean up is deferred.  This can be induced, however, by starting a call
on an AF_RXRPC socket and then closing the socket without reading the
reply.

Fix this by having rxrpc_rcu_destroy_call() punt the destruction to a
workqueue if in softirq-mode and defer the destruction to process context.

Note that another way to fix this could be to add a bunch of bh-disable
annotations to the spinlocks concerned - and there might be more than just
those two - but that means spending more time with BHs disabled.

Note also that some of these places were covered by bh-disable spinlocks
belonging to the rxrpc_transport object, but these got removed without the
_bh annotation being retained on the next lock in.

Fixes: 999b69f892 ("rxrpc: Kill the client connection bundle concept")
Reported-by: syzbot+d82f3ac8d87e7ccbb2c9@syzkaller.appspotmail.com
Reported-by: syzbot+3f1fd6b8cbf8702d134e@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Hillf Danton <hdanton@sina.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-07 11:20:57 +01:00
..
af_rxrpc.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-01-30 21:50:41 +00:00
ar-internal.h rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-03 10:25:30 +00:00
call_accept.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
call_event.c rxrpc: Use the tx-phase skb flag to simplify tracing 2019-08-27 10:04:18 +01:00
call_object.c rxrpc: Fix call RCU cleanup using non-bh-safe locks 2020-02-07 11:20:57 +01:00
conn_client.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-03 10:25:30 +00:00
conn_event.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-01-30 21:50:41 +00:00
conn_object.c rxrpc: Fix service call disconnection 2020-02-07 11:19:38 +01:00
conn_service.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
input.c rxrpc: Fix insufficient receive notification generation 2020-01-30 21:50:41 +00:00
insecure.c rxrpc: Fix -Wframe-larger-than= warnings from on-stack crypto 2019-07-30 10:32:35 -07:00
Kconfig crypto: skcipher - rename the crypto_blkcipher module and kconfig option 2019-11-01 13:42:47 +08:00
key.c Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs" 2019-07-10 18:43:43 -07:00
local_event.c rxrpc: Use the tx-phase skb flag to simplify tracing 2019-08-27 10:04:18 +01:00
local_object.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-01-30 21:50:41 +00:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
misc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
net_ns.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
output.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-03 10:25:30 +00:00
peer_event.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-01-30 21:50:41 +00:00
peer_object.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-10-20 10:43:00 -07:00
proc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
protocol.h rxrpc: Improve jumbo packet counting 2019-08-27 09:48:37 +01:00
recvmsg.c rxrpc: Fix handling of last subpacket of jumbo packet 2019-10-31 12:23:09 -07:00
rxkad.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
security.c rxrpc: Fix missing security check on incoming calls 2019-12-20 16:21:32 +00:00
sendmsg.c rxrpc: Fix call crypto state cleanup 2019-10-07 11:05:05 +01:00
skbuff.c rxrpc: Use skb_unshare() rather than skb_cow_data() 2019-08-27 10:13:46 +01:00
sysctl.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00