Re: [PATCH net] l2tp: Don't sleep and disable BH under writer-side sk_callback_lock

From: Tom Parkin <tparkin@katalix.com>
To: Guillaume Nault <gnault@redhat.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Jakub Sitnicki <jakub@cloudflare.com>,
	netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	syzbot+703d9e154b3b58277261@syzkaller.appspotmail.com,
	syzbot+50680ced9e98a61f7698@syzkaller.appspotmail.com,
	syzbot+de987172bb74a381879b@syzkaller.appspotmail.com
Subject: Re: [PATCH net] l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
Date: Thu, 24 Nov 2022 10:07:51 +0000	[thread overview]
Message-ID: <20221124100751.GA6671@katalix.com> (raw)
In-Reply-To: <20221123152400.GA18177@pc-4.home>

[-- Attachment #1: Type: text/plain, Size: 1726 bytes --]

On  Wed, Nov 23, 2022 at 16:24:00 +0100, Guillaume Nault wrote:
> On Tue, Nov 22, 2022 at 11:28:45PM +0900, Tetsuo Handa wrote:
> > That's what I thought at https://lkml.kernel.org/r/c64284f4-2c2a-ecb9-a08e-9e49d49c720b@I-love.SAKURA.ne.jp .
> > 
> > But the problem is not that setup_udp_tunnel_sock() can sleep. The problem is that lockdep
> > gets confused due to changing lockdep class after the socket is already published. We need
> > to avoid calling lockdep_set_class_and_name() on a socket retrieved via sockfd_lookup().
> 
> This is a second problem. The problem of setting sk_user_data under
> sk_callback_lock write protection (while still calling
> udp_tunnel_encap_enable() from sleepable context) still remains.
> 
> For lockdep_set_class_and_name(), maybe we could store the necessary
> socket information (addresses, ports and checksum configuration) in the
> l2tp_tunnel structure, thus avoiding the need to read them from the
> socket. This way, we could stop locking the user space socket in
> l2tp_xmit_core() and drop the lockdep_set_class_and_name() call.
> I think either you or Jakub proposed something like this in another
> thread.

I note that l2tp_xmit_core calls ip_queue_xmit which expects a socket
atomic context*.

It also accesses struct inet_sock corking data which may also need locks
to safely access.

Possibly we could somehow work around that, but on the face of it we'd
need to do a bit more work to avoid the socket lock in the tx path.

* davem fixed locking in the l2tp xmit path in:

6af88da14ee2 ("l2tp: Fix locking in l2tp_core.c")
-- 
Tom Parkin
Katalix Systems Ltd
https://katalix.com
Catalysts for your Embedded Linux software development

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]