David Howells 8371666ef4 rxrpc: Fix locking issue ... [ Upstream commit ad25f5cb39 ] There's a locking issue with the per-netns list of calls in rxrpc. The pieces of code that add and remove a call from the list use write_lock() and the calls procfile uses read_lock() to access it. However, the timer callback function may trigger a removal by trying to queue a call for processing and finding that it's already queued - at which point it has a spare refcount that it has to do something with. Unfortunately, if it puts the call and this reduces the refcount to 0, the call will be removed from the list. Unfortunately, since the _bh variants of the locking functions aren't used, this can deadlock. ================================ WARNING: inconsistent lock state 5.18.0-rc3-build4+ #10 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/2/25 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff888107ac4038 (&rxnet->call_lock){+.?.}-{2:2}, at: rxrpc_put_call+0x103/0x14b {SOFTIRQ-ON-W} state was registered at: ... Possible unsafe locking scenario: CPU0 ---- lock(&rxnet->call_lock); <Interrupt> lock(&rxnet->call_lock); *** DEADLOCK *** 1 lock held by ksoftirqd/2/25: #0: ffff8881008ffdb0 ((&call->timer)){+.-.}-{0:0}, at: call_timer_fn+0x5/0x23d Changes ======= ver #2) - Changed to using list_next_rcu() rather than rcu_dereference() directly. Fixes: 17926a7932 ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells <dhowells@redhat.com> cc: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-07-12 16:35:08 +02:00
..
af_rxrpc.c
ar-internal.h	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
call_accept.c	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
call_event.c	rxrpc: Don't try to resend the request if we're receiving the reply	2022-06-09 10:23:02 +02:00
call_object.c	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
conn_client.c	rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()	2021-12-08 09:04:48 +01:00
conn_event.c
conn_object.c	rxrpc, afs: Fix selection of abort codes	2022-06-09 10:22:40 +02:00
conn_service.c
input.c	rxrpc: Fix decision on when to generate an IDLE ACK	2022-06-09 10:23:02 +02:00
insecure.c
Kconfig
key.c
local_event.c
local_object.c	rxrpc: Enable IPv6 checksums on transport socket	2022-05-12 12:30:19 +02:00
Makefile
misc.c
net_ns.c	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
output.c	rxrpc: Fix decision on when to generate an IDLE ACK	2022-06-09 10:23:02 +02:00
peer_event.c
peer_object.c	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:04:49 +01:00
proc.c	rxrpc: Fix locking issue	2022-07-12 16:35:08 +02:00
protocol.h
recvmsg.c	rxrpc: Fix decision on when to generate an IDLE ACK	2022-06-09 10:23:02 +02:00
rtt.c
rxkad.c
security.c
sendmsg.c	rxrpc: Return an error to sendmsg if call failed	2022-06-09 10:22:40 +02:00
server_key.c	rxrpc: fix some null-ptr-deref bugs in server_key.c	2022-04-08 14:24:10 +02:00
skbuff.c
sysctl.c	rxrpc: Fix listen() setting the bar too high for the prealloc rings	2022-06-09 10:23:02 +02:00
utils.c