Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751980AbdFJJBR (ORCPT ); Sat, 10 Jun 2017 05:01:17 -0400 Received: from m12-13.163.com ([220.181.12.13]:41340 "EHLO m12-13.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751870AbdFJJBP (ORCPT ); Sat, 10 Jun 2017 05:01:15 -0400 From: Jia-Ju Bai To: jon.maloy@ericsson.com, ying.xue@windriver.com, davem@davemloft.net Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH] net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse Date: Sat, 10 Jun 2017 17:03:35 +0800 Message-Id: <1497085415-630-1-git-send-email-baijiaju1990@163.com> X-Mailer: git-send-email 1.7.9.5 X-CM-TRANSID: DcCowACnRVFDtTtZU1L4Jg--.39852S2 X-Coremail-Antispam: 1Uf129KBjvdXoWruFWrKFW5ZryfAFWrZw18Krg_yoWDArgEgF s3ZFWxA348G3s8Ww4UAayxKryrt3yrCF1UCFnxZFy8K3s8JrZaqFZ09F15A3s8Wr4xCw15 Jr1fW3W8Ar13XjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IUjqQ6tUUUUU== X-Originating-IP: [166.111.70.19] X-CM-SenderInfo: xedlyx5dmximizq6il2tof0z/1tbiYwfyelaDtT-KvgAAsH Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1035 Lines: 37 The kernel may sleep under a rcu read lock in tipc_msg_reverse, and the function call path is: tipc_l2_rcv_msg (acquire the lock by rcu_read_lock) tipc_rcv tipc_sk_rcv tipc_msg_reverse pskb_expand_head(GFP_KERNEL) --> may sleep tipc_node_broadcast tipc_node_xmit_skb tipc_node_xmit tipc_sk_rcv tipc_msg_reverse pskb_expand_head(GFP_KERNEL) --> may sleep To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC". Signed-off-by: Jia-Ju Bai --- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 312ef7d..ab30876 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err) } if (skb_cloned(_skb) && - pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL)) + pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC)) goto exit; /* Now reverse the concerned fields */ -- 1.7.9.5