Received: by 2002:a05:6358:5282:b0:b5:90e7:25cb with SMTP id g2csp1877171rwa; Sun, 21 Aug 2022 20:03:41 -0700 (PDT) X-Google-Smtp-Source: AA6agR5qoPhBxCGEz40jLo7KwQ6JwdDcuP0IMjx3c59+lbSD4hmrejeoqGEk1QPhUsc/Y798nlh1 X-Received: by 2002:a17:907:6930:b0:733:621:8437 with SMTP id rb48-20020a170907693000b0073306218437mr11549009ejc.111.1661137420966; Sun, 21 Aug 2022 20:03:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1661137420; cv=none; d=google.com; s=arc-20160816; b=zPhuuNxHmUanjBEDqsM0Ep9Q/QJATxvgk7dN26M9E+F4G+BqWue6Y+9FxpLaGfPTzU pOtGubmNWNefY7U661rDuoS9+cosLSBsAMAjqucxSfm0n8QLSwaT/OI+Rzh5LIvZ1w13 Y5qKxza2OoNUUAowYjq+aBU4v4/bj6wunIeWeH8pF0A++YCev6shyIg7euEedhvVc/Zs gIMTbNwqIJmUk+nj/uEnB3DzOKtwAGxsbEtJmvhyaQRnfuRWo1xg4ridtilfeaJrhmXh VY8mM3DQNuK80B4BOd7Nc33rh63YCFWCE1jOJcksnl3O/6DruB3RUm2OD2s/AlbQGeuI hLpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=7JBqBRAB17o1JeJQw+NHaufOJp69q2sMMmrxZfsIc6Y=; b=eRc4bBQoiLn2A8eOL97vj+9+Ou2tNn3CK0EhxKY9pC1i/zdxoDzP2NuPSdoI5Q0bqT jqI618zwPMRcjpMx/ORVj/OOLqoFCvSS94oM+G/WEB8pdzyDroHP08Pi5NZ9goS9lsQW 4GWF7FiljZAwol9Z3QgGMdsOzg1PizZQYVM+n7pNaLqhEyxDPu6CeFh44gJ7NBz2uLNg 4/aqDoGngDKIlLFwUwqL8dcMI8GMHWGDeh94asimn2lNcOFJw+AAQxRXtSxi4onx8601 JsXFVD2sO36ZuODsvDGmGTByQARQYJ2MdRuBpRAMUKyVMlYXT3Osp2+a+jhVTuMKYzpC Xclw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id nb36-20020a1709071ca400b0073d615565fesi5269131ejc.494.2022.08.21.20.03.12; Sun, 21 Aug 2022 20:03:40 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232605AbiHVCpt (ORCPT + 99 others); Sun, 21 Aug 2022 22:45:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231970AbiHVCpr (ORCPT ); Sun, 21 Aug 2022 22:45:47 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC9A324093; Sun, 21 Aug 2022 19:45:46 -0700 (PDT) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4M9xW41R67znTVF; Mon, 22 Aug 2022 10:43:28 +0800 (CST) Received: from dggpemm500007.china.huawei.com (7.185.36.183) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 22 Aug 2022 10:45:44 +0800 Received: from huawei.com (10.175.103.91) by dggpemm500007.china.huawei.com (7.185.36.183) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 22 Aug 2022 10:45:44 +0800 From: Yang Yingliang To: , CC: , , , , Subject: [PATCH net v2 RESEND] net: neigh: don't call kfree_skb() under spin_lock_irqsave() Date: Mon, 22 Aug 2022 10:53:46 +0800 Message-ID: <20220822025346.3758558-1-yangyingliang@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.103.91] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpemm500007.china.huawei.com (7.185.36.183) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So add all skb to a tmp list, then free them after spin_unlock_irqrestore() at once. Fixes: 66ba215cb513 ("neigh: fix possible DoS due to net iface start/stop loop") Suggested-by: Denis V. Lunev Signed-off-by: Yang Yingliang --- v2: move all skb to a tmp list, then free them after spin_unlock_irqrestore(). --- net/core/neighbour.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 5b669eb80270..78cc8fb68814 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -309,14 +309,17 @@ static int neigh_del_timer(struct neighbour *n) static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net) { + struct sk_buff_head tmp; unsigned long flags; struct sk_buff *skb; + skb_queue_head_init(&tmp); spin_lock_irqsave(&list->lock, flags); skb = skb_peek(list); while (skb != NULL) { struct sk_buff *skb_next = skb_peek_next(skb, list); struct net_device *dev = skb->dev; + if (net == NULL || net_eq(dev_net(dev), net)) { struct in_device *in_dev; @@ -326,13 +329,16 @@ static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net) in_dev->arp_parms->qlen--; rcu_read_unlock(); __skb_unlink(skb, list); - - dev_put(dev); - kfree_skb(skb); + __skb_queue_tail(&tmp, skb); } skb = skb_next; } spin_unlock_irqrestore(&list->lock, flags); + + while ((skb = __skb_dequeue(&tmp))) { + dev_put(skb->dev); + kfree_skb(skb); + } } static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev, -- 2.25.1