From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>,
syzbot <syzbot+0f1827363a305f74996f@syzkaller.appspotmail.com>,
Kirill Tkhai <ktkhai@virtuozzo.com>,
Oliver Hartkopp <socketcan@hartkopp.net>,
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>,
Marc Kleine-Budde <mkl@pengutronix.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: [PATCH 4.9 45/71] can: bcm/raw/isotp: use per module netdevice notifier
Date: Mon, 28 Jun 2021 10:39:37 -0400 [thread overview]
Message-ID: <20210628144003.34260-46-sashal@kernel.org> (raw)
In-Reply-To: <20210628144003.34260-1-sashal@kernel.org>
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
commit 8d0caedb759683041d9db82069937525999ada53 upstream.
syzbot is reporting hung task at register_netdevice_notifier() [1] and
unregister_netdevice_notifier() [2], for cleanup_net() might perform
time consuming operations while CAN driver's raw/bcm/isotp modules are
calling {register,unregister}_netdevice_notifier() on each socket.
Change raw/bcm/isotp modules to call register_netdevice_notifier() from
module's __init function and call unregister_netdevice_notifier() from
module's __exit function, as with gw/j1939 modules are doing.
Link: https://syzkaller.appspot.com/bug?id=391b9498827788b3cc6830226d4ff5be87107c30 [1]
Link: https://syzkaller.appspot.com/bug?id=1724d278c83ca6e6df100a2e320c10d991cf2bce [2]
Link: https://lore.kernel.org/r/54a5f451-05ed-f977-8534-79e7aa2bcc8f@i-love.sakura.ne.jp
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+0f1827363a305f74996f@syzkaller.appspotmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/bcm.c | 61 +++++++++++++++++++++++++++++++++++++++-----------
net/can/raw.c | 62 +++++++++++++++++++++++++++++++++++++++------------
2 files changed, 96 insertions(+), 27 deletions(-)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 077606585ed9..65fa0ac2fb47 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -127,7 +127,7 @@ struct bcm_sock {
struct sock sk;
int bound;
int ifindex;
- struct notifier_block notifier;
+ struct list_head notifier;
struct list_head rx_ops;
struct list_head tx_ops;
unsigned long dropped_usr_msgs;
@@ -135,6 +135,10 @@ struct bcm_sock {
char procname [32]; /* inode number in decimal with \0 */
};
+static LIST_HEAD(bcm_notifier_list);
+static DEFINE_SPINLOCK(bcm_notifier_lock);
+static struct bcm_sock *bcm_busy_notifier;
+
static inline struct bcm_sock *bcm_sk(const struct sock *sk)
{
return (struct bcm_sock *)sk;
@@ -1439,20 +1443,15 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
/*
* notification handler for netdevice status changes
*/
-static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
- void *ptr)
+static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
+ struct net_device *dev)
{
- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
- struct bcm_sock *bo = container_of(nb, struct bcm_sock, notifier);
struct sock *sk = &bo->sk;
struct bcm_op *op;
int notify_enodev = 0;
if (!net_eq(dev_net(dev), &init_net))
- return NOTIFY_DONE;
-
- if (dev->type != ARPHRD_CAN)
- return NOTIFY_DONE;
+ return;
switch (msg) {
@@ -1487,7 +1486,28 @@ static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
sk->sk_error_report(sk);
}
}
+}
+static int bcm_notifier(struct notifier_block *nb, unsigned long msg,
+ void *ptr)
+{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+ if (dev->type != ARPHRD_CAN)
+ return NOTIFY_DONE;
+ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
+ return NOTIFY_DONE;
+ if (unlikely(bcm_busy_notifier)) /* Check for reentrant bug. */
+ return NOTIFY_DONE;
+
+ spin_lock(&bcm_notifier_lock);
+ list_for_each_entry(bcm_busy_notifier, &bcm_notifier_list, notifier) {
+ spin_unlock(&bcm_notifier_lock);
+ bcm_notify(bcm_busy_notifier, msg, dev);
+ spin_lock(&bcm_notifier_lock);
+ }
+ bcm_busy_notifier = NULL;
+ spin_unlock(&bcm_notifier_lock);
return NOTIFY_DONE;
}
@@ -1507,9 +1527,9 @@ static int bcm_init(struct sock *sk)
INIT_LIST_HEAD(&bo->rx_ops);
/* set notifier */
- bo->notifier.notifier_call = bcm_notifier;
-
- register_netdevice_notifier(&bo->notifier);
+ spin_lock(&bcm_notifier_lock);
+ list_add_tail(&bo->notifier, &bcm_notifier_list);
+ spin_unlock(&bcm_notifier_lock);
return 0;
}
@@ -1530,7 +1550,14 @@ static int bcm_release(struct socket *sock)
/* remove bcm_ops, timer, rx_unregister(), etc. */
- unregister_netdevice_notifier(&bo->notifier);
+ spin_lock(&bcm_notifier_lock);
+ while (bcm_busy_notifier == bo) {
+ spin_unlock(&bcm_notifier_lock);
+ schedule_timeout_uninterruptible(1);
+ spin_lock(&bcm_notifier_lock);
+ }
+ list_del(&bo->notifier);
+ spin_unlock(&bcm_notifier_lock);
lock_sock(sk);
@@ -1716,6 +1743,10 @@ static const struct can_proto bcm_can_proto = {
.prot = &bcm_proto,
};
+static struct notifier_block canbcm_notifier = {
+ .notifier_call = bcm_notifier
+};
+
static int __init bcm_module_init(void)
{
int err;
@@ -1730,6 +1761,8 @@ static int __init bcm_module_init(void)
/* create /proc/net/can-bcm directory */
proc_dir = proc_mkdir("can-bcm", init_net.proc_net);
+ register_netdevice_notifier(&canbcm_notifier);
+
return 0;
}
@@ -1739,6 +1772,8 @@ static void __exit bcm_module_exit(void)
if (proc_dir)
remove_proc_entry("can-bcm", init_net.proc_net);
+
+ unregister_netdevice_notifier(&canbcm_notifier);
}
module_init(bcm_module_init);
diff --git a/net/can/raw.c b/net/can/raw.c
index 6dc546a06673..2bb50b1535c2 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -84,7 +84,7 @@ struct raw_sock {
struct sock sk;
int bound;
int ifindex;
- struct notifier_block notifier;
+ struct list_head notifier;
int loopback;
int recv_own_msgs;
int fd_frames;
@@ -96,6 +96,10 @@ struct raw_sock {
struct uniqframe __percpu *uniq;
};
+static LIST_HEAD(raw_notifier_list);
+static DEFINE_SPINLOCK(raw_notifier_lock);
+static struct raw_sock *raw_busy_notifier;
+
/*
* Return pointer to store the extra msg flags for raw_recvmsg().
* We use the space of one unsigned int beyond the 'struct sockaddr_can'
@@ -260,21 +264,16 @@ static int raw_enable_allfilters(struct net_device *dev, struct sock *sk)
return err;
}
-static int raw_notifier(struct notifier_block *nb,
- unsigned long msg, void *ptr)
+static void raw_notify(struct raw_sock *ro, unsigned long msg,
+ struct net_device *dev)
{
- struct net_device *dev = netdev_notifier_info_to_dev(ptr);
- struct raw_sock *ro = container_of(nb, struct raw_sock, notifier);
struct sock *sk = &ro->sk;
if (!net_eq(dev_net(dev), &init_net))
- return NOTIFY_DONE;
-
- if (dev->type != ARPHRD_CAN)
- return NOTIFY_DONE;
+ return;
if (ro->ifindex != dev->ifindex)
- return NOTIFY_DONE;
+ return;
switch (msg) {
@@ -303,7 +302,28 @@ static int raw_notifier(struct notifier_block *nb,
sk->sk_error_report(sk);
break;
}
+}
+
+static int raw_notifier(struct notifier_block *nb, unsigned long msg,
+ void *ptr)
+{
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+
+ if (dev->type != ARPHRD_CAN)
+ return NOTIFY_DONE;
+ if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN)
+ return NOTIFY_DONE;
+ if (unlikely(raw_busy_notifier)) /* Check for reentrant bug. */
+ return NOTIFY_DONE;
+ spin_lock(&raw_notifier_lock);
+ list_for_each_entry(raw_busy_notifier, &raw_notifier_list, notifier) {
+ spin_unlock(&raw_notifier_lock);
+ raw_notify(raw_busy_notifier, msg, dev);
+ spin_lock(&raw_notifier_lock);
+ }
+ raw_busy_notifier = NULL;
+ spin_unlock(&raw_notifier_lock);
return NOTIFY_DONE;
}
@@ -332,9 +352,9 @@ static int raw_init(struct sock *sk)
return -ENOMEM;
/* set notifier */
- ro->notifier.notifier_call = raw_notifier;
-
- register_netdevice_notifier(&ro->notifier);
+ spin_lock(&raw_notifier_lock);
+ list_add_tail(&ro->notifier, &raw_notifier_list);
+ spin_unlock(&raw_notifier_lock);
return 0;
}
@@ -349,7 +369,14 @@ static int raw_release(struct socket *sock)
ro = raw_sk(sk);
- unregister_netdevice_notifier(&ro->notifier);
+ spin_lock(&raw_notifier_lock);
+ while (raw_busy_notifier == ro) {
+ spin_unlock(&raw_notifier_lock);
+ schedule_timeout_uninterruptible(1);
+ spin_lock(&raw_notifier_lock);
+ }
+ list_del(&ro->notifier);
+ spin_unlock(&raw_notifier_lock);
lock_sock(sk);
@@ -857,6 +884,10 @@ static const struct can_proto raw_can_proto = {
.prot = &raw_proto,
};
+static struct notifier_block canraw_notifier = {
+ .notifier_call = raw_notifier
+};
+
static __init int raw_module_init(void)
{
int err;
@@ -866,6 +897,8 @@ static __init int raw_module_init(void)
err = can_proto_register(&raw_can_proto);
if (err < 0)
printk(KERN_ERR "can: registration of raw protocol failed\n");
+ else
+ register_netdevice_notifier(&canraw_notifier);
return err;
}
@@ -873,6 +906,7 @@ static __init int raw_module_init(void)
static __exit void raw_module_exit(void)
{
can_proto_unregister(&raw_can_proto);
+ unregister_netdevice_notifier(&canraw_notifier);
}
module_init(raw_module_init);
--
2.30.2
next prev parent reply other threads:[~2021-06-28 15:22 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-28 14:38 [PATCH 4.9 00/71] 4.9.274-rc1 review Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 01/71] net: ieee802154: fix null deref in parse dev addr Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 02/71] HID: hid-sensor-hub: Return error for hid_set_field() failure Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 03/71] HID: Add BUS_VIRTUAL to hid_connect logging Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 04/71] HID: usbhid: fix info leak in hid_submit_ctrl Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 05/71] ARM: OMAP2+: Fix build warning when mmc_omap is not built Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 06/71] HID: gt683r: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-06-28 14:38 ` [PATCH 4.9 07/71] gfs2: Fix use-after-free in gfs2_glock_shrink_scan Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 08/71] scsi: target: core: Fix warning on realtime kernels Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 09/71] ethernet: myri10ge: Fix missing error code in myri10ge_probe() Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 10/71] net: ipconfig: Don't override command-line hostnames or domains Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 11/71] rtnetlink: Fix missing error code in rtnl_bridge_notify() Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 12/71] net/x25: Return the correct errno code Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 13/71] net: " Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 14/71] fib: " Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 15/71] dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 16/71] dmaengine: stedma40: add missing iounmap() on error in d40_probe() Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 17/71] mm: hwpoison: change PageHWPoison behavior on hugetlb pages Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 18/71] batman-adv: Avoid WARN_ON timing related checks Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 19/71] net: ipv4: fix memory leak in netlbl_cipsov4_add_std Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 20/71] net: rds: fix memory leak in rds_recvmsg Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 21/71] udp: fix race between close() and udp_abort() Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 22/71] rtnetlink: Fix regression in bridge VLAN configuration Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 23/71] netfilter: synproxy: Fix out of bounds when parsing TCP options Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 24/71] alx: Fix an error handling path in 'alx_probe()' Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 25/71] net: stmmac: dwmac1000: Fix extended MAC address registers definition Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 26/71] qlcnic: Fix an error handling path in 'qlcnic_probe()' Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 27/71] netxen_nic: Fix an error handling path in 'netxen_nic_probe()' Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 28/71] net: cdc_ncm: switch to eth%d interface naming Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 29/71] net: usb: fix possible use-after-free in smsc75xx_bind Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 30/71] net: ipv4: fix memory leak in ip_mc_add1_src Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 31/71] net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 32/71] be2net: Fix an error handling path in 'be_probe()' Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 33/71] net: hamradio: fix memory leak in mkiss_close Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 34/71] net: cdc_eem: fix tx fixup skb leak Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 35/71] net: ethernet: fix potential use-after-free in ec_bhf_remove Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 36/71] scsi: core: Put .shost_dev in failure path if host state changes to RUNNING Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 37/71] radeon: use memcpy_to/fromio for UVD fw upload Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 38/71] can: bcm: fix infoleak in struct bcm_msg_head Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 39/71] tracing: Do no increment trace_clock_global() by one Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 40/71] PCI: Mark TI C667X to avoid bus reset Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 41/71] PCI: Mark some NVIDIA GPUs " Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 42/71] ARCv2: save ABI registers across signal handling Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 43/71] dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 44/71] net: fec_ptp: add clock rate zero check Sasha Levin
2021-06-28 14:39 ` Sasha Levin [this message]
2021-06-28 14:39 ` [PATCH 4.9 46/71] usb: dwc3: core: fix kernel panic when do reboot Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 47/71] tracing: Do not stop recording cmdlines when tracing is off Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 48/71] tracing: Do not stop recording comms if the trace file is being read Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 49/71] x86/fpu: Reset state for all signal restore failures Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 50/71] inet: use bigger hash table for IP ID generation Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 51/71] i40e: Be much more verbose about what we can and cannot offload Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 52/71] ARM: 9081/1: fix gcc-10 thumb2-kernel regression Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 53/71] Makefile: Move -Wno-unused-but-set-variable out of GCC only block Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 54/71] arm64: perf: Disable PMU while processing counter overflows Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 55/71] Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 56/71] mac80211: remove warning in ieee80211_get_sband() Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 57/71] cfg80211: call cfg80211_leave_ocb when switching away from OCB Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 58/71] mac80211: drop multicast fragments Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 59/71] ping: Check return value of function 'ping_queue_rcv_skb' Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 60/71] inet: annotate date races around sk->sk_txhash Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 61/71] net: caif: fix memory leak in ldisc_open Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 62/71] net/packet: annotate accesses to po->bind Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 63/71] net/packet: annotate accesses to po->ifindex Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 64/71] r8152: Avoid memcpy() over-reading of ETH_SS_STATS Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 65/71] sh_eth: " Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 66/71] r8169: " Sasha Levin
2021-06-28 14:39 ` [PATCH 4.9 67/71] net: qed: Fix memcpy() overflow of qed_dcbx_params() Sasha Levin
2021-06-28 14:40 ` [PATCH 4.9 68/71] net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY Sasha Levin
2021-06-28 14:40 ` [PATCH 4.9 69/71] nilfs2: fix memory leak in nilfs_sysfs_delete_device_group Sasha Levin
2021-06-28 14:40 ` [PATCH 4.9 70/71] i2c: robotfuzz-osif: fix control-request directions Sasha Levin
2021-06-28 14:40 ` [PATCH 4.9 71/71] Linux 4.9.274-rc1 Sasha Levin
2021-06-29 12:50 ` [PATCH 4.9 00/71] 4.9.274-rc1 review Naresh Kamboju
2021-06-29 14:11 ` Guenter Roeck
2021-06-29 22:07 ` Sasha Levin
2021-06-29 18:18 ` Guenter Roeck
2021-06-29 23:43 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210628144003.34260-46-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=ktkhai@virtuozzo.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
--cc=syzbot+0f1827363a305f74996f@syzkaller.appspotmail.com \
--cc=syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).