Received: by 10.223.185.116 with SMTP id b49csp1042113wrg; Fri, 23 Feb 2018 10:51:54 -0800 (PST) X-Google-Smtp-Source: AH8x227kKEHOyrQyuaXzfbPU7XuFgmzg8ilXxI7JW8jWgUCeVGvcbG6+DrOW8R4Gc9hi1SC/vIHF X-Received: by 10.98.101.195 with SMTP id z186mr2662844pfb.47.1519411914767; Fri, 23 Feb 2018 10:51:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519411914; cv=none; d=google.com; s=arc-20160816; b=NEdGxhDmcMioO1nPfQ0Q43NcMfLmjDHafhTEHvlVgyIQepElbrPjvckOC50OF7u4Tj /hde4fO9qx3QD6MtMNE0Un6ZCO1Zts8aRJ70TTDvExNnqZ6+CC/5/c4t29mv3kYGHgjZ AK5/NatCReEbKBflAMVE56ha/6zYzqT/S6GhSqmEn4ejow8swcaowg1AopqnMbLCE7R1 mPBYtSUyXCmdZlkNznaNIl3NDUQ+wRToW/Lz2e9tRBVkQAr1neF5xxCZsFWCtd7I6KKk qkBHJKyJnIB+Wug+mC6iby1x1zFHKg6wc6Azp2pUvw/OUXoAkbEi3OSBvNQdkyL/PwPU egaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=jq314Kj8KOZsuwbluaoJjdfloSWHBRqHDu/Lz+6ECdU=; b=hnDssonpxsnSYEOO2TEnNj1mN5GnJlL8i+2+ZoxV4//l/xQoQ4vuI1+UvJO5oFewo3 seqAlrMIFTep1hrHud20qWi+xF50GRGmEiKmeydlpC9fQ14SRFDgjI/QV5zkkMk8yYei 7yNiptrPahtWPJmBLTWwo6YLyuESJsEeN1kl3blud0kMecTWqNGDUEhvFoRBvVbISLn9 cOU6r1rXHiJ6fqQJcLbpw5i2I8HFIS7DT2+obKerenQMdonXDbt+aBd1j0e6MbD+jicI Y+0lMyioFrG0HEonoGUQmgKwtZFAOFDc2JILynElqWcJ9bRz4DfRXczJbQA1cbRDnE7T oe8A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 32-v6si2151190plg.555.2018.02.23.10.51.40; Fri, 23 Feb 2018 10:51:54 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934871AbeBWSvC (ORCPT + 99 others); Fri, 23 Feb 2018 13:51:02 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:45896 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934306AbeBWSu6 (ORCPT ); Fri, 23 Feb 2018 13:50:58 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 3832E12E8; Fri, 23 Feb 2018 18:50:58 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Sowmini Varadhan , Santosh Shilimkar , "David S. Miller" Subject: [PATCH 4.14 042/159] rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete Date: Fri, 23 Feb 2018 19:25:50 +0100 Message-Id: <20180223170748.490604442@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sowmini Varadhan commit f10b4cff98c6977668434fbf5dd58695eeca2897 upstream. The rds_tcp_kill_sock() function parses the rds_tcp_conn_list to find the rds_connection entries marked for deletion as part of the netns deletion under the protection of the rds_tcp_conn_lock. Since the rds_tcp_conn_list tracks rds_tcp_connections (which have a 1:1 mapping with rds_conn_path), multiple tc entries in the rds_tcp_conn_list will map to a single rds_connection, and will be deleted as part of the rds_conn_destroy() operation that is done outside the rds_tcp_conn_lock. The rds_tcp_conn_list traversal done under the protection of rds_tcp_conn_lock should not leave any doomed tc entries in the list after the rds_tcp_conn_lock is released, else another concurrently executiong netns delete (for a differnt netns) thread may trip on these entries. Reported-by: syzbot Signed-off-by: Sowmini Varadhan Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/rds/tcp.c | 9 +++++++-- net/rds/tcp.h | 1 + 2 files changed, 8 insertions(+), 2 deletions(-) --- a/net/rds/tcp.c +++ b/net/rds/tcp.c @@ -306,7 +306,8 @@ static void rds_tcp_conn_free(void *arg) rdsdebug("freeing tc %p\n", tc); spin_lock_irqsave(&rds_tcp_conn_lock, flags); - list_del(&tc->t_tcp_node); + if (!tc->t_tcp_node_detached) + list_del(&tc->t_tcp_node); spin_unlock_irqrestore(&rds_tcp_conn_lock, flags); kmem_cache_free(rds_tcp_conn_slab, tc); @@ -531,8 +532,12 @@ static void rds_tcp_kill_sock(struct net if (net != c_net || !tc->t_sock) continue; - if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) + if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) { list_move_tail(&tc->t_tcp_node, &tmp_list); + } else { + list_del(&tc->t_tcp_node); + tc->t_tcp_node_detached = true; + } } spin_unlock_irq(&rds_tcp_conn_lock); list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) { --- a/net/rds/tcp.h +++ b/net/rds/tcp.h @@ -12,6 +12,7 @@ struct rds_tcp_incoming { struct rds_tcp_connection { struct list_head t_tcp_node; + bool t_tcp_node_detached; struct rds_conn_path *t_cpath; /* t_conn_path_lock synchronizes the connection establishment between * rds_tcp_accept_one and rds_tcp_conn_path_connect