From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net] sctp: not allow transport timeout value less than HZ/5 for hb_timer Date: Tue, 05 Jun 2018 10:23:39 -0400 (EDT) Message-ID: <20180605.102339.1043965092278555314.davem@davemloft.net> References: <97b99fac474db414ea8486a1fbd3a37dacd4b1b1.1528172218.git.lucien.xin@gmail.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, linux-sctp@vger.kernel.org, edumazet@google.com, marcelo.leitner@gmail.com, nhorman@tuxdriver.com, dvyukov@google.com, syzkaller@googlegroups.com To: lucien.xin@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:36774 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752249AbeFEOXl (ORCPT ); Tue, 5 Jun 2018 10:23:41 -0400 In-Reply-To: <97b99fac474db414ea8486a1fbd3a37dacd4b1b1.1528172218.git.lucien.xin@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: From: Xin Long Date: Tue, 5 Jun 2018 12:16:58 +0800 > syzbot reported a rcu_sched self-detected stall on CPU which is caused > by too small value set on rto_min with SCTP_RTOINFO sockopt. With this > value, hb_timer will get stuck there, as in its timer handler it starts > this timer again with this value, then goes to the timer handler again. > > This problem is there since very beginning, and thanks to Eric for the > reproducer shared from a syzbot mail. > > This patch fixes it by not allowing sctp_transport_timeout to return a > smaller value than HZ/5 for hb_timer, which is based on TCP's min rto. > > Note that it doesn't fix this issue by limiting rto_min, as some users > are still using small rto and no proper value was found for it yet. > > Reported-by: syzbot+3dcd59a1f907245f891f@syzkaller.appspotmail.com > Suggested-by: Marcelo Ricardo Leitner > Signed-off-by: Xin Long Applied and queued up for -stable, thanks Xin.