* [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
2019-09-19 2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
@ 2019-09-19 2:58 ` Xiaoming Ni
2019-09-19 6:36 ` Greg KH
2019-09-19 2:58 ` [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register() Xiaoming Ni
2019-09-19 2:58 ` [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register() Xiaoming Ni
2 siblings, 1 reply; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19 2:58 UTC (permalink / raw)
To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
paulmck, semen.protsenko, stern, tglx, trond.myklebust,
viresh.kumar
Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
linux-nfs, netdev
Registering the same notifier to a hook repeatedly can cause the hook
list to form a ring or lose other members of the list.
case1: An infinite loop in notifier_chain_register() can cause soft lockup
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test2);
case2: An infinite loop in notifier_chain_register() can cause soft lockup
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
case3: lose other hook test2
atomic_notifier_chain_register(&test_notifier_list, &test1);
atomic_notifier_chain_register(&test_notifier_list, &test2);
atomic_notifier_chain_register(&test_notifier_list, &test1);
case4: Unregister returns 0, but the hook is still in the linked list,
and it is not really registered. If you call notifier_call_chain
after ko is unloaded, it will trigger oops.
If the system is configured with softlockup_panic and the same
hook is repeatedly registered on the panic_notifier_list, it
will cause a loop panic.
Add a check in notifier_chain_register(),
Intercepting duplicate registrations to avoid infinite loops
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
---
kernel/notifier.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/notifier.c b/kernel/notifier.c
index d9f5081..30bedb8 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -23,7 +23,10 @@ static int notifier_chain_register(struct notifier_block **nl,
struct notifier_block *n)
{
while ((*nl) != NULL) {
- WARN_ONCE(((*nl) == n), "double register detected");
+ if (unlikely((*nl) == n)) {
+ WARN(1, "double register detected");
+ return 0;
+ }
if (n->priority > (*nl)->priority)
break;
nl = &((*nl)->next);
--
1.8.5.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
2019-09-19 2:58 ` [PATCH v4 1/3] " Xiaoming Ni
@ 2019-09-19 6:36 ` Greg KH
2019-09-19 12:55 ` Xiaoming Ni
0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2019-09-19 6:36 UTC (permalink / raw)
To: Xiaoming Ni
Cc: akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan, bfields,
chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey, paulmck,
semen.protsenko, stern, tglx, trond.myklebust, viresh.kumar,
stable, dylix.dailei, yuehaibing, linux-kernel, linux-nfs,
netdev
On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote:
> Registering the same notifier to a hook repeatedly can cause the hook
> list to form a ring or lose other members of the list.
>
> case1: An infinite loop in notifier_chain_register() can cause soft lockup
> atomic_notifier_chain_register(&test_notifier_list, &test1);
> atomic_notifier_chain_register(&test_notifier_list, &test1);
> atomic_notifier_chain_register(&test_notifier_list, &test2);
>
> case2: An infinite loop in notifier_chain_register() can cause soft lockup
> atomic_notifier_chain_register(&test_notifier_list, &test1);
> atomic_notifier_chain_register(&test_notifier_list, &test1);
> atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
>
> case3: lose other hook test2
> atomic_notifier_chain_register(&test_notifier_list, &test1);
> atomic_notifier_chain_register(&test_notifier_list, &test2);
> atomic_notifier_chain_register(&test_notifier_list, &test1);
>
> case4: Unregister returns 0, but the hook is still in the linked list,
> and it is not really registered. If you call notifier_call_chain
> after ko is unloaded, it will trigger oops.
>
> If the system is configured with softlockup_panic and the same
> hook is repeatedly registered on the panic_notifier_list, it
> will cause a loop panic.
>
> Add a check in notifier_chain_register(),
> Intercepting duplicate registrations to avoid infinite loops
>
> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
> Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
> ---
> kernel/notifier.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
<formletter>
This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.
</formletter>
Same thing goes for all of the patches in this series.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4 1/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops
2019-09-19 6:36 ` Greg KH
@ 2019-09-19 12:55 ` Xiaoming Ni
0 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19 12:55 UTC (permalink / raw)
To: Greg KH
Cc: akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan, bfields,
chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey, paulmck,
semen.protsenko, stern, tglx, trond.myklebust, viresh.kumar,
stable, dylix.dailei, yuehaibing, linux-kernel, linux-nfs,
netdev
On 2019/9/19 14:36, Greg KH wrote:
> On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote:
>> Registering the same notifier to a hook repeatedly can cause the hook
>> list to form a ring or lose other members of the list.
>>
>> case1: An infinite loop in notifier_chain_register() can cause soft lockup
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>> atomic_notifier_chain_register(&test_notifier_list, &test2);
>>
>> case2: An infinite loop in notifier_chain_register() can cause soft lockup
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>> atomic_notifier_call_chain(&test_notifier_list, 0, NULL);
>>
>> case3: lose other hook test2
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>> atomic_notifier_chain_register(&test_notifier_list, &test2);
>> atomic_notifier_chain_register(&test_notifier_list, &test1);
>>
>> case4: Unregister returns 0, but the hook is still in the linked list,
>> and it is not really registered. If you call notifier_call_chain
>> after ko is unloaded, it will trigger oops.
>>
>> If the system is configured with softlockup_panic and the same
>> hook is repeatedly registered on the panic_notifier_list, it
>> will cause a loop panic.
>>
>> Add a check in notifier_chain_register(),
>> Intercepting duplicate registrations to avoid infinite loops
>>
>> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
>> Reviewed-by: Vasily Averin <vvs@virtuozzo.com>
>> ---
>> kernel/notifier.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> <formletter>
>
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree. Please read:
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
>
thanks for your guidance
I thought that as long as the code exists in the stable branch, it should be copied to stable@kernel.org
it is my mistake,
These patches are intended to be sent to the main line.
Should I resend it again?
> </formletter>
>
> Same thing goes for all of the patches in this series.
>
> thanks,
>
> greg k-h
>
> .
>
thanks
Xiaoming Ni
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register()
2019-09-19 2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
2019-09-19 2:58 ` [PATCH v4 1/3] " Xiaoming Ni
@ 2019-09-19 2:58 ` Xiaoming Ni
2019-09-19 2:58 ` [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register() Xiaoming Ni
2 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19 2:58 UTC (permalink / raw)
To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
paulmck, semen.protsenko, stern, tglx, trond.myklebust,
viresh.kumar
Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
linux-nfs, netdev
The only difference between notifier_chain_cond_register() and
notifier_chain_register() is the lack of warning hints for duplicate
registrations.
Consider using notifier_chain_register() instead of
notifier_chain_cond_register() to avoid duplicate code
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
---
kernel/notifier.c | 17 +----------------
1 file changed, 1 insertion(+), 16 deletions(-)
diff --git a/kernel/notifier.c b/kernel/notifier.c
index 30bedb8..e3d221f 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -36,21 +36,6 @@ static int notifier_chain_register(struct notifier_block **nl,
return 0;
}
-static int notifier_chain_cond_register(struct notifier_block **nl,
- struct notifier_block *n)
-{
- while ((*nl) != NULL) {
- if ((*nl) == n)
- return 0;
- if (n->priority > (*nl)->priority)
- break;
- nl = &((*nl)->next);
- }
- n->next = *nl;
- rcu_assign_pointer(*nl, n);
- return 0;
-}
-
static int notifier_chain_unregister(struct notifier_block **nl,
struct notifier_block *n)
{
@@ -252,7 +237,7 @@ int blocking_notifier_chain_cond_register(struct blocking_notifier_head *nh,
int ret;
down_write(&nh->rwsem);
- ret = notifier_chain_cond_register(&nh->head, n);
+ ret = notifier_chain_register(&nh->head, n);
up_write(&nh->rwsem);
return ret;
}
--
1.8.5.6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v4 3/3] kernel/notifier.c: remove blocking_notifier_chain_cond_register()
2019-09-19 2:58 [PATCH v4 0/3] kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops Xiaoming Ni
2019-09-19 2:58 ` [PATCH v4 1/3] " Xiaoming Ni
2019-09-19 2:58 ` [PATCH v4 2/3] kernel/notifier.c: remove notifier_chain_cond_register() Xiaoming Ni
@ 2019-09-19 2:58 ` Xiaoming Ni
2 siblings, 0 replies; 6+ messages in thread
From: Xiaoming Ni @ 2019-09-19 2:58 UTC (permalink / raw)
To: gregkh, akpm, vvs, torvalds, adobriyan, anna.schumaker, arjan,
bfields, chuck.lever, davem, jlayton, luto, mingo, Nadia.Derbey,
paulmck, semen.protsenko, stern, tglx, trond.myklebust,
viresh.kumar
Cc: stable, dylix.dailei, nixiaoming, yuehaibing, linux-kernel,
linux-nfs, netdev
blocking_notifier_chain_cond_register() does not consider
system_booting state, which is the only difference between this
function and blocking_notifier_cain_register(). This can be a bug
and is a piece of duplicate code.
Delete blocking_notifier_chain_cond_register()
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
---
include/linux/notifier.h | 4 ----
kernel/notifier.c | 23 -----------------------
net/sunrpc/rpc_pipe.c | 2 +-
3 files changed, 1 insertion(+), 28 deletions(-)
diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index 0096a05..0189476 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -150,10 +150,6 @@ extern int raw_notifier_chain_register(struct raw_notifier_head *nh,
extern int srcu_notifier_chain_register(struct srcu_notifier_head *nh,
struct notifier_block *nb);
-extern int blocking_notifier_chain_cond_register(
- struct blocking_notifier_head *nh,
- struct notifier_block *nb);
-
extern int atomic_notifier_chain_unregister(struct atomic_notifier_head *nh,
struct notifier_block *nb);
extern int blocking_notifier_chain_unregister(struct blocking_notifier_head *nh,
diff --git a/kernel/notifier.c b/kernel/notifier.c
index e3d221f..63d7501 100644
--- a/kernel/notifier.c
+++ b/kernel/notifier.c
@@ -221,29 +221,6 @@ int blocking_notifier_chain_register(struct blocking_notifier_head *nh,
EXPORT_SYMBOL_GPL(blocking_notifier_chain_register);
/**
- * blocking_notifier_chain_cond_register - Cond add notifier to a blocking notifier chain
- * @nh: Pointer to head of the blocking notifier chain
- * @n: New entry in notifier chain
- *
- * Adds a notifier to a blocking notifier chain, only if not already
- * present in the chain.
- * Must be called in process context.
- *
- * Currently always returns zero.
- */
-int blocking_notifier_chain_cond_register(struct blocking_notifier_head *nh,
- struct notifier_block *n)
-{
- int ret;
-
- down_write(&nh->rwsem);
- ret = notifier_chain_register(&nh->head, n);
- up_write(&nh->rwsem);
- return ret;
-}
-EXPORT_SYMBOL_GPL(blocking_notifier_chain_cond_register);
-
-/**
* blocking_notifier_chain_unregister - Remove notifier from a blocking notifier chain
* @nh: Pointer to head of the blocking notifier chain
* @n: Entry to remove from notifier chain
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index b71a39d..39e14d5 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -51,7 +51,7 @@
int rpc_pipefs_notifier_register(struct notifier_block *nb)
{
- return blocking_notifier_chain_cond_register(&rpc_pipefs_notifier_list, nb);
+ return blocking_notifier_chain_register(&rpc_pipefs_notifier_list, nb);
}
EXPORT_SYMBOL_GPL(rpc_pipefs_notifier_register);
--
1.8.5.6
^ permalink raw reply related [flat|nested] 6+ messages in thread