From: nixiaoming <nixiaoming@huawei.com>
To: <davem@davemloft.net>, <edumazet@google.com>,
<waltje@uWalt.NL.Mugnet.ORG>, <gw4pts@gw4pts.ampr.org>,
<andreyknvl@google.com>, <tklauser@distanz.ch>,
<philip.pettersson@gmail.com>, <glider@google.com>
Cc: <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<nixiaoming@huawei.com>, <dede.wu@huawei.com>
Subject: [PATCH] net/packet: fix race condition between fanout_add and __unregister_prot_hook
Date: Thu, 14 Sep 2017 10:40:46 +0800 [thread overview]
Message-ID: <20170914024046.92505-1-nixiaoming@huawei.com> (raw)
If fanout_add is preempted after running po-> fanout = match
and before running __fanout_link,
it will cause BUG_ON when __unregister_prot_hook call __fanout_unlink
so, we need add mutex_lock(&fanout_mutex) to __unregister_prot_hook
or add spin_lock(&po->bind_lock) before po-> fanout = match
test on linux 4.1.42:
./trinity -c setsockopt -C 2 -X &
BUG: failure at net/packet/af_packet.c:1414/__fanout_unlink()!
Kernel panic - not syncing: BUG!
CPU: 2 PID: 2271 Comm: trinity-c0 Tainted: G W O 4.1.12 #1
Hardware name: Hisilicon PhosphorHi1382 FPGA (DT)
Call trace:
[<ffffffc000209414>] dump_backtrace+0x0/0xf8
[<ffffffc00020952c>] show_stack+0x20/0x28
[<ffffffc000635574>] dump_stack+0xac/0xe4
[<ffffffc000633fb8>] panic+0xf8/0x268
[<ffffffc0005fa778>] __unregister_prot_hook+0xa0/0x144
[<ffffffc0005fba48>] packet_set_ring+0x280/0x5b4
[<ffffffc0005fc33c>] packet_setsockopt+0x320/0x950
[<ffffffc000554a04>] SyS_setsockopt+0xa4/0xd4
Signed-off-by: nixiaoming <nixiaoming@huawei.com>
Tested-by: wudesheng <dede.wu@huawei.com>
---
net/packet/af_packet.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 008a45c..0300146 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -365,10 +365,12 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
po->running = 0;
+ mutex_lock(&fanout_mutex);
if (po->fanout)
__fanout_unlink(sk, po);
else
__dev_remove_pack(&po->prot_hook);
+ mutex_unlock(&fanout_mutex);
__sock_put(sk);
--
2.11.0.1
next reply other threads:[~2017-09-14 2:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-14 2:40 nixiaoming [this message]
2017-09-14 11:22 ` [PATCH] net/packet: fix race condition between fanout_add and __unregister_prot_hook Willem de Bruijn
2017-09-17 1:42 ` [lkp-robot] [net/packet] d5013a2d16: BUG:sleeping_function_called_from_invalid_context_at_kernel/locking/mutex.c kernel test robot
2017-09-14 2:44 [PATCH] net/packet: fix race condition between fanout_add and __unregister_prot_hook nixiaoming
2017-09-14 14:07 nixiaoming
2017-09-14 14:35 ` Willem de Bruijn
2017-09-15 17:41 ` Cong Wang
2017-09-15 17:46 ` Willem de Bruijn
2017-09-15 18:09 ` Cong Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170914024046.92505-1-nixiaoming@huawei.com \
--to=nixiaoming@huawei.com \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=dede.wu@huawei.com \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=gw4pts@gw4pts.ampr.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=philip.pettersson@gmail.com \
--cc=tklauser@distanz.ch \
--cc=waltje@uWalt.NL.Mugnet.ORG \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).