Patch "net:rds: Fix possible deadlock in rds_message_put" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    net:rds: Fix possible deadlock in rds_message_put

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-rds-fix-possible-deadlock-in-rds_message_put.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6886f936fe465fa7580e235758b78e0c7f459bd6
Author: Allison Henderson <allison.henderson@xxxxxxxxxx>
Date:   Thu Feb 8 19:28:54 2024 -0700

    net:rds: Fix possible deadlock in rds_message_put
    
    [ Upstream commit f1acf1ac84d2ae97b7889b87223c1064df850069 ]
    
    Functions rds_still_queued and rds_clear_recv_queue lock a given socket
    in order to safely iterate over the incoming rds messages. However
    calling rds_inc_put while under this lock creates a potential deadlock.
    rds_inc_put may eventually call rds_message_purge, which will lock
    m_rs_lock. This is the incorrect locking order since m_rs_lock is
    meant to be locked before the socket. To fix this, we move the message
    item to a local list or variable that wont need rs_recv_lock protection.
    Then we can safely call rds_inc_put on any item stored locally after
    rs_recv_lock is released.
    
    Fixes: bdbe6fbc6a2f ("RDS: recv.c")
    Reported-by: syzbot+f9db6ff27b9bfdcfeca0@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reported-by: syzbot+dcd73ff9291e6d34b3ab@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Allison Henderson <allison.henderson@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/rds/recv.c b/net/rds/recv.c
index 5b426dc3634d1..a316180d3c32e 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -424,6 +424,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 	struct sock *sk = rds_rs_to_sk(rs);
 	int ret = 0;
 	unsigned long flags;
+	struct rds_incoming *to_drop = NULL;
 
 	write_lock_irqsave(&rs->rs_recv_lock, flags);
 	if (!list_empty(&inc->i_item)) {
@@ -434,11 +435,14 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 					      -be32_to_cpu(inc->i_hdr.h_len),
 					      inc->i_hdr.h_dport);
 			list_del_init(&inc->i_item);
-			rds_inc_put(inc);
+			to_drop = inc;
 		}
 	}
 	write_unlock_irqrestore(&rs->rs_recv_lock, flags);
 
+	if (to_drop)
+		rds_inc_put(to_drop);
+
 	rdsdebug("inc %p rs %p still %d dropped %d\n", inc, rs, ret, drop);
 	return ret;
 }
@@ -757,16 +761,21 @@ void rds_clear_recv_queue(struct rds_sock *rs)
 	struct sock *sk = rds_rs_to_sk(rs);
 	struct rds_incoming *inc, *tmp;
 	unsigned long flags;
+	LIST_HEAD(to_drop);
 
 	write_lock_irqsave(&rs->rs_recv_lock, flags);
 	list_for_each_entry_safe(inc, tmp, &rs->rs_recv_queue, i_item) {
 		rds_recv_rcvbuf_delta(rs, sk, inc->i_conn->c_lcong,
 				      -be32_to_cpu(inc->i_hdr.h_len),
 				      inc->i_hdr.h_dport);
+		list_move(&inc->i_item, &to_drop);
+	}
+	write_unlock_irqrestore(&rs->rs_recv_lock, flags);
+
+	list_for_each_entry_safe(inc, tmp, &to_drop, i_item) {
 		list_del_init(&inc->i_item);
 		rds_inc_put(inc);
 	}
-	write_unlock_irqrestore(&rs->rs_recv_lock, flags);
 }
 
 /*




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux