Linux-NFS Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
@ 2019-09-19  2:58 Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 1/3] " Xiaoming Ni
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19  2:58 UTC (permalink / raw)
  To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
	bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
	paulmck, semen.protsenko, stern, tglx, trond.myklebust,
	viresh.kumar
  Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
	linux-nfs, netdev

Registering the same notifier to a hook repeatedly can cause the hook
list to form a ring or lose other members of the list.
so, need add a check in in notifier_chain_register(),
intercepting duplicate registrations to avoid infinite loops


v1:
* use notifier_chain_cond_register replace notifier_chain_register

v2:
* Add a check in notifier_chain_register() to avoid duplicate registration
* remove notifier_chain_cond_register() to avoid duplicate code 
* remove blocking_notifier_chain_cond_register() to avoid duplicate code

v3:
* Add a cover letter.

v4:
* Add Reviewed-by and adjust the title.

Xiaoming Ni (3):
  kernel/notifier.c: intercepting duplicate registrations to avoid
    infinite loops
  kernel/notifier.c: remove notifier_chain_cond_register()
  kernel/notifier.c: remove blocking_notifier_chain_cond_register()

 include/linux/notifier.h |  4 ----
 kernel/notifier.c        | 41 +++--------------------------------------
 net/sunrpc/rpc_pipe.c    |  2 +-
 3 files changed, 4 insertions(+), 43 deletions(-)

-- 
1.8.5.6


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
  2019-09-19  2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
@ 2019-09-19  2:58 ` " Xiaoming Ni
  2019-09-19  6:36   ` Greg KH
  2019-09-19  2:58 ` [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register() Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register() Xiaoming Ni
  2 siblings, 1 reply; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19  2:58 UTC (permalink / raw)
  To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
	bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
	paulmck, semen.protsenko, stern, tglx, trond.myklebust,
	viresh.kumar
  Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
	linux-nfs, netdev

Registering the same notifier to a hook repeatedly can cause the hook
list to form a ring or lose other members of the list.

case1: An infinite loop in notifier_chain_register() can cause soft lockup
        atomic_notifier_chain_register(&test_notifier_list, &test1);
        atomic_notifier_chain_register(&test_notifier_list, &test1);
        atomic_notifier_chain_register(&test_notifier_list, &test2);

case2: An infinite loop in notifier_chain_register() can cause soft lockup
        atomic_notifier_chain_register(&test_notifier_list, &test1);
        atomic_notifier_chain_register(&test_notifier_list, &test1);
        atomic_notifier_call_chain(&test_notifier_list, 0, NULL);

case3: lose other hook test2
        atomic_notifier_chain_register(&test_notifier_list, &test1);
        atomic_notifier_chain_register(&test_notifier_list, &test2);
        atomic_notifier_chain_register(&test_notifier_list, &test1);

case4: Unregister returns 0, but the hook is still in the linked list,
        and it is not really registered. If you call notifier_call_chain
        after ko is unloaded, it will trigger oops.

If the system is configured with softlockup_panic and the same
hook is repeatedly registered on the panic_notifier_list, it
will cause a loop panic.

Add a check in notifier_chain_register(),
Intercepting duplicate registrations to avoid infinite loops

Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
---
 kernel/notifier.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/notifier.c b/kernel/notifier.c
index d9f5081..30bedb8 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -23,7 +23,10 @@ static int notifier_chain_register(struct notifier_block **nl,
 		struct notifier_block *n)
 {
 	while ((*nl) != NULL) {
-		WARN_ONCE(((*nl) == n), "double register detected");
+		if (unlikely((*nl) == n)) {
+			WARN(1, "double register detected");
+			return 0;
+		}
 		if (n->priority > (*nl)->priority)
 			break;
 		nl = &((*nl)->next);
-- 
1.8.5.6


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register()
  2019-09-19  2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 1/3] " Xiaoming Ni
@ 2019-09-19  2:58 ` Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register() Xiaoming Ni
  2 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19  2:58 UTC (permalink / raw)
  To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
	bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
	paulmck, semen.protsenko, stern, tglx, trond.myklebust,
	viresh.kumar
  Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
	linux-nfs, netdev

The only difference between notifier_chain_cond_register() and
notifier_chain_register() is the lack of warning hints for duplicate
registrations.
Consider using notifier_chain_register() instead of
notifier_chain_cond_register() to avoid duplicate code

Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
---
 kernel/notifier.c | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/kernel/notifier.c b/kernel/notifier.c
index 30bedb8..e3d221f 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -36,21 +36,6 @@ static int notifier_chain_register(struct notifier_block **nl,
 	return 0;
 }
 
-static int notifier_chain_cond_register(struct notifier_block **nl,
-		struct notifier_block *n)
-{
-	while ((*nl) != NULL) {
-		if ((*nl) == n)
-			return 0;
-		if (n->priority > (*nl)->priority)
-			break;
-		nl = &((*nl)->next);
-	}
-	n->next = *nl;
-	rcu_assign_pointer(*nl, n);
-	return 0;
-}
-
 static int notifier_chain_unregister(struct notifier_block **nl,
 		struct notifier_block *n)
 {
@@ -252,7 +237,7 @@ int blocking_notifier_chain_cond_register(struct blocking_notifier_head *nh,
 	int ret;
 
 	down_write(&nh->rwsem);
-	ret = notifier_chain_cond_register(&nh->head, n);
+	ret = notifier_chain_register(&nh->head, n);
 	up_write(&nh->rwsem);
 	return ret;
 }
-- 
1.8.5.6


^ permalink raw reply	[flat|nested] 6+ messages in thread

* [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register()
  2019-09-19  2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 1/3] " Xiaoming Ni
  2019-09-19  2:58 ` [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register() Xiaoming Ni
@ 2019-09-19  2:58 ` Xiaoming Ni
  2 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19  2:58 UTC (permalink / raw)
  To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
	bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
	paulmck, semen.protsenko, stern, tglx, trond.myklebust,
	viresh.kumar
  Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
	linux-nfs, netdev

blocking_notifier_chain_cond_register() does not consider
system_booting state, which is the only difference between this
function and blocking_notifier_cain_register(). This can be a bug
and is a piece of duplicate code.

Delete blocking_notifier_chain_cond_register()

Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
---
 include/linux/notifier.h |  4 ----
 kernel/notifier.c        | 23 -----------------------
 net/sunrpc/rpc_pipe.c    |  2 +-
 3 files changed, 1 insertion(+), 28 deletions(-)

diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index 0096a05..0189476 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -150,10 +150,6 @@ extern int raw_notifier_chain_register(struct raw_notifier_head *nh,
 extern int srcu_notifier_chain_register(struct srcu_notifier_head *nh,
 		struct notifier_block *nb);
 
-extern int blocking_notifier_chain_cond_register(
-		struct blocking_notifier_head *nh,
-		struct notifier_block *nb);
-
 extern int atomic_notifier_chain_unregister(struct atomic_notifier_head *nh,
 		struct notifier_block *nb);
 extern int blocking_notifier_chain_unregister(struct blocking_notifier_head *nh,
diff --git a/kernel/notifier.c b/kernel/notifier.c
index e3d221f..63d7501 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -221,29 +221,6 @@ int blocking_notifier_chain_register(struct blocking_notifier_head *nh,
 EXPORT_SYMBOL_GPL(blocking_notifier_chain_register);
 
 /**
- *	blocking_notifier_chain_cond_register - Cond add notifier to a blocking notifier chain
- *	@nh: Pointer to head of the blocking notifier chain
- *	@n: New entry in notifier chain
- *
- *	Adds a notifier to a blocking notifier chain, only if not already
- *	present in the chain.
- *	Must be called in process context.
- *
- *	Currently always returns zero.
- */
-int blocking_notifier_chain_cond_register(struct blocking_notifier_head *nh,
-		struct notifier_block *n)
-{
-	int ret;
-
-	down_write(&nh->rwsem);
-	ret = notifier_chain_register(&nh->head, n);
-	up_write(&nh->rwsem);
-	return ret;
-}
-EXPORT_SYMBOL_GPL(blocking_notifier_chain_cond_register);
-
-/**
  *	blocking_notifier_chain_unregister - Remove notifier from a blocking notifier chain
  *	@nh: Pointer to head of the blocking notifier chain
  *	@n: Entry to remove from notifier chain
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index b71a39d..39e14d5 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -51,7 +51,7 @@
 
 int rpc_pipefs_notifier_register(struct notifier_block *nb)
 {
-	return blocking_notifier_chain_cond_register(&rpc_pipefs_notifier_list, nb);
+	return blocking_notifier_chain_register(&rpc_pipefs_notifier_list, nb);
 }
 EXPORT_SYMBOL_GPL(rpc_pipefs_notifier_register);
 
-- 
1.8.5.6


^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
  2019-09-19  2:58 ` [PATCH v4 1/3] " Xiaoming Ni
@ 2019-09-19  6:36   ` Greg KH
  2019-09-19 12:55     ` Xiaoming Ni
  0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2019-09-19  6:36 UTC (permalink / raw)
  To: Xiaoming Ni
  Cc: akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan, bfields,
	chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey, paulmck,
	semen.protsenko, stern, tglx, trond.myklebust, viresh.kumar,
	stable, dylix.dailei, yuehaibing, linux-kernel, linux-nfs,
	netdev

On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote:
> Registering the same notifier to a hook repeatedly can cause the hook
> list to form a ring or lose other members of the list.
> 
> case1: An infinite loop in notifier_chain_register() can cause soft lockup
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>         atomic_notifier_chain_register(&test_notifier_list, &test2);
> 
> case2: An infinite loop in notifier_chain_register() can cause soft lockup
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>         atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
> 
> case3: lose other hook test2
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>         atomic_notifier_chain_register(&test_notifier_list, &test2);
>         atomic_notifier_chain_register(&test_notifier_list, &test1);
> 
> case4: Unregister returns 0, but the hook is still in the linked list,
>         and it is not really registered. If you call notifier_call_chain
>         after ko is unloaded, it will trigger oops.
> 
> If the system is configured with softlockup_panic and the same
> hook is repeatedly registered on the panic_notifier_list, it
> will cause a loop panic.
> 
> Add a check in notifier_chain_register(),
> Intercepting duplicate registrations to avoid infinite loops
> 
> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
> Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>  kernel/notifier.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

Same thing goes for all of the patches in this series.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
  2019-09-19  6:36   ` Greg KH
@ 2019-09-19 12:55     ` Xiaoming Ni
  0 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19 12:55 UTC (permalink / raw)
  To: Greg KH
  Cc: akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan, bfields,
	chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey, paulmck,
	semen.protsenko, stern, tglx, trond.myklebust, viresh.kumar,
	stable, dylix.dailei, yuehaibing, linux-kernel, linux-nfs,
	netdev

On 2019/9/19 14:36, Greg KH wrote:
> On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote:
>> Registering the same notifier to a hook repeatedly can cause the hook
>> list to form a ring or lose other members of the list.
>>
>> case1: An infinite loop in notifier_chain_register() can cause soft lockup
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>         atomic_notifier_chain_register(&test_notifier_list, &test2);
>>
>> case2: An infinite loop in notifier_chain_register() can cause soft lockup
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>         atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
>>
>> case3: lose other hook test2
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>         atomic_notifier_chain_register(&test_notifier_list, &test2);
>>         atomic_notifier_chain_register(&test_notifier_list, &test1);
>>
>> case4: Unregister returns 0, but the hook is still in the linked list,
>>         and it is not really registered. If you call notifier_call_chain
>>         after ko is unloaded, it will trigger oops.
>>
>> If the system is configured with softlockup_panic and the same
>> hook is repeatedly registered on the panic_notifier_list, it
>> will cause a loop panic.
>>
>> Add a check in notifier_chain_register(),
>> Intercepting duplicate registrations to avoid infinite loops
>>
>> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
>> Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
>> ---
>>  kernel/notifier.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> <formletter>
> 
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree.  Please read:
>     https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
> 
thanks for your guidance
I thought that as long as the code exists in the stable branch, it should be copied to stable@kernel.org
it is my mistake,

These patches are intended to be sent to the main line.
Should I resend it again?

> </formletter>
> 
> Same thing goes for all of the patches in this series.
> 
> thanks,
> 
> greg k-h
> 
> .
> 

thanks

Xiaoming Ni


^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, back to index

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-19  2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
2019-09-19  2:58 ` [PATCH v4 1/3] " Xiaoming Ni
2019-09-19  6:36   ` Greg KH
2019-09-19 12:55     ` Xiaoming Ni
2019-09-19  2:58 ` [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register() Xiaoming Ni
2019-09-19  2:58 ` [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register() Xiaoming Ni

Linux-NFS Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-nfs/0 linux-nfs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-nfs linux-nfs/ https://lore.kernel.org/linux-nfs \
		linux-nfs@vger.kernel.org
	public-inbox-index linux-nfs

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-nfs


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git