Netdev Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] tipc: Disable preemption when calling send_msg method.
@ 2020-05-20 11:45 Tetsuo Handa
  2020-05-22 21:45 ` Eric Dumazet
  0 siblings, 1 reply; 2+ messages in thread
From: Tetsuo Handa @ 2020-05-20 11:45 UTC (permalink / raw)
  To: Jon Maloy, Ying Xue; +Cc: netdev, Tetsuo Handa

syzbot is reporting that tipc_udp_send_msg() is calling dst_cache_get()
without preemption disabled [1]. Since b->media->send_msg() is called
with RCU lock already held, we can also disable preemption at that point.

[1] https://syzkaller.appspot.com/bug?id=dc6352b92862eb79373fe03fdf9af5928753e057

Reported-by: syzbot+1a68504d96cd17b33a05@syzkaller.appspotmail.com
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 net/tipc/bearer.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 34ca7b789eba..e5cf91665881 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -516,6 +516,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
 	struct tipc_msg *hdr = buf_msg(skb);
 	struct tipc_bearer *b;
 
+	preempt_disable();
 	rcu_read_lock();
 	b = bearer_get(net, bearer_id);
 	if (likely(b && (test_bit(0, &b->up) || msg_is_reset(hdr)))) {
@@ -528,6 +529,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
 		kfree_skb(skb);
 	}
 	rcu_read_unlock();
+	preempt_enable();
 }
 
 /* tipc_bearer_xmit() -send buffer to destination over bearer
@@ -543,6 +545,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 	if (skb_queue_empty(xmitq))
 		return;
 
+	preempt_disable();
 	rcu_read_lock();
 	b = bearer_get(net, bearer_id);
 	if (unlikely(!b))
@@ -560,6 +563,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 		}
 	}
 	rcu_read_unlock();
+	preempt_enable();
 }
 
 /* tipc_bearer_bc_xmit() - broadcast buffers to all destinations
@@ -574,6 +578,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
 	struct sk_buff *skb, *tmp;
 	struct tipc_msg *hdr;
 
+	preempt_disable();
 	rcu_read_lock();
 	b = bearer_get(net, bearer_id);
 	if (unlikely(!b || !test_bit(0, &b->up)))
@@ -591,6 +596,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
 			b->media->send_msg(net, skb, b, dst);
 	}
 	rcu_read_unlock();
+	preempt_enable();
 }
 
 /**
-- 
2.18.2


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] tipc: Disable preemption when calling send_msg method.
  2020-05-20 11:45 [PATCH] tipc: Disable preemption when calling send_msg method Tetsuo Handa
@ 2020-05-22 21:45 ` Eric Dumazet
  0 siblings, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2020-05-22 21:45 UTC (permalink / raw)
  To: Tetsuo Handa, Jon Maloy, Ying Xue; +Cc: netdev



On 5/20/20 4:45 AM, Tetsuo Handa wrote:
> syzbot is reporting that tipc_udp_send_msg() is calling dst_cache_get()
> without preemption disabled [1]. Since b->media->send_msg() is called
> with RCU lock already held, we can also disable preemption at that point.
> 
> [1] https://syzkaller.appspot.com/bug?id=dc6352b92862eb79373fe03fdf9af5928753e057
> 
> Reported-by: syzbot+1a68504d96cd17b33a05@syzkaller.appspotmail.com
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> ---
>  net/tipc/bearer.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
> index 34ca7b789eba..e5cf91665881 100644
> --- a/net/tipc/bearer.c
> +++ b/net/tipc/bearer.c
> @@ -516,6 +516,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
>  	struct tipc_msg *hdr = buf_msg(skb);
>  	struct tipc_bearer *b;
>  
> +	preempt_disable();
>  	rcu_read_lock();
>  	b = bearer_get(net, bearer_id);
>  	if (likely(b && (test_bit(0, &b->up) || msg_is_reset(hdr)))) {
> @@ -528,6 +529,7 @@ void tipc_bearer_xmit_skb(struct net *net, u32 bearer_id,
>  		kfree_skb(skb);
>  	}
>  	rcu_read_unlock();
> +	preempt_enable();
>  }
>  
>  /* tipc_bearer_xmit() -send buffer to destination over bearer
> @@ -543,6 +545,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
>  	if (skb_queue_empty(xmitq))
>  		return;
>  
> +	preempt_disable();
>  	rcu_read_lock();
>  	b = bearer_get(net, bearer_id);
>  	if (unlikely(!b))
> @@ -560,6 +563,7 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
>  		}
>  	}
>  	rcu_read_unlock();
> +	preempt_enable();
>  }
>  
>  /* tipc_bearer_bc_xmit() - broadcast buffers to all destinations
> @@ -574,6 +578,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
>  	struct sk_buff *skb, *tmp;
>  	struct tipc_msg *hdr;
>  
> +	preempt_disable();
>  	rcu_read_lock();
>  	b = bearer_get(net, bearer_id);
>  	if (unlikely(!b || !test_bit(0, &b->up)))
> @@ -591,6 +596,7 @@ void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
>  			b->media->send_msg(net, skb, b, dst);
>  	}
>  	rcu_read_unlock();
> +	preempt_enable();
>  }
>  
>  /**
> 


This is wrong, see my patch instead.

https://patchwork.ozlabs.org/project/netdev/patch/20200521182958.163436-1-edumazet@google.com/ 

Thanks.


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-20 11:45 [PATCH] tipc: Disable preemption when calling send_msg method Tetsuo Handa
2020-05-22 21:45 ` Eric Dumazet

Netdev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git
	git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \
		netdev@vger.kernel.org
	public-inbox-index netdev

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netdev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git