• David Howells's avatar
    rxrpc: Fix client call connect/disconnect race · 4fb70c21
    David Howells authored
    [ Upstream commit 930c9f9125c85b5134b3e711bc252ecc094708e3 ]
    
    rxrpc_disconnect_client_call() reads the call's connection ID protocol
    value (call->cid) as part of that function's variable declarations.  This
    is bad because it's not inside the locked section and so may race with
    someone granting use of the channel to the call.
    
    This manifests as an assertion failure (see below) where the call in the
    presumed channel (0 because call->cid wasn't set when we read it) doesn't
    match the call attached to the channel we were actually granted (if 1, 2 or
    3).
    
    Fix this by moving the read and dependent calculations inside of the
    channel_lock section.  Also, only set the channel number and pointer
    variables if cid is not zero (ie. unset).
    
    This problem can be induced by injecting an occasional error in
    rxrpc_wait_for_channel() before the call to schedule().
    
    Make two further changes also:
    
     (1) Add a trace for wait failure in rxrpc_connect_call().
    
     (2) Drop channel_lock before BUG'ing in the case of the assertion failure.
    
    The failure causes a trace akin to the following:
    
    rxrpc: Assertion failed - 18446612685268945920(0xffff8880beab8c00) == 18446612685268621312(0xffff8880bea69800) is false
    ------------[ cut here ]------------
    kernel BUG at net/rxrpc/conn_client.c:824!
    ...
    RIP: 0010:rxrpc_disconnect_client_call+0x2bf/0x99d
    ...
    Call Trace:
     rxrpc_connect_call+0x902/0x9b3
     ? wake_up_q+0x54/0x54
     rxrpc_new_client_call+0x3a0/0x751
     ? rxrpc_kernel_begin_call+0x141/0x1bc
     ? afs_alloc_call+0x1b5/0x1b5
     rxrpc_kernel_begin_call+0x141/0x1bc
     afs_make_call+0x20c/0x525
     ? afs_alloc_call+0x1b5/0x1b5
     ? __lock_is_held+0x40/0x71
     ? lockdep_init_map+0xaf/0x193
     ? lockdep_init_map+0xaf/0x193
     ? __lock_is_held+0x40/0x71
     ? yfs_fs_fetch_data+0x33b/0x34a
     yfs_fs_fetch_data+0x33b/0x34a
     afs_fetch_data+0xdc/0x3b7
     afs_read_dir+0x52d/0x97f
     afs_dir_iterate+0xa0/0x661
     ? iterate_dir+0x63/0x141
     iterate_dir+0xa2/0x141
     ksys_getdents64+0x9f/0x11b
     ? filldir+0x111/0x111
     ? do_syscall_64+0x3e/0x1a0
     __x64_sys_getdents64+0x16/0x19
     do_syscall_64+0x7d/0x1a0
     entry_SYSCALL_64_after_hwframe+0x49/0xbe
    
    Fixes: 45025bce ("rxrpc: Improve management and caching of client connection objects")
    Signed-off-by: 's avatarDavid Howells <dhowells@redhat.com>
    Reviewed-by: 's avatarMarc Dionne <marc.dionne@auristor.com>
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: 's avatarSasha Levin <sashal@kernel.org>
    4fb70c21
Name
Last commit
Last update
..
6lowpan Loading commit data...
802 Loading commit data...
8021q Loading commit data...
9p Loading commit data...
appletalk Loading commit data...
atm Loading commit data...
ax25 Loading commit data...
batman-adv Loading commit data...
bluetooth Loading commit data...
bpf Loading commit data...
bpfilter Loading commit data...
bridge Loading commit data...
caif Loading commit data...
can Loading commit data...
ceph Loading commit data...
core Loading commit data...
dcb Loading commit data...
dccp Loading commit data...
decnet Loading commit data...
dns_resolver Loading commit data...
dsa Loading commit data...
ethernet Loading commit data...
hsr Loading commit data...
ieee802154 Loading commit data...
ife Loading commit data...
ipv4 Loading commit data...
ipv6 Loading commit data...
iucv Loading commit data...
kcm Loading commit data...
key Loading commit data...
l2tp Loading commit data...
l3mdev Loading commit data...
lapb Loading commit data...
llc Loading commit data...
mac80211 Loading commit data...
mac802154 Loading commit data...
mpls Loading commit data...
ncsi Loading commit data...
netfilter Loading commit data...
netlabel Loading commit data...
netlink Loading commit data...
netrom Loading commit data...
nfc Loading commit data...
nsh Loading commit data...
openvswitch Loading commit data...
packet Loading commit data...
phonet Loading commit data...
psample Loading commit data...
qrtr Loading commit data...
rds Loading commit data...
rfkill Loading commit data...
rose Loading commit data...
rxrpc Loading commit data...
sched Loading commit data...
sctp Loading commit data...
smc Loading commit data...
strparser Loading commit data...
sunrpc Loading commit data...
switchdev Loading commit data...
tipc Loading commit data...
tls Loading commit data...
unix Loading commit data...
vmw_vsock Loading commit data...
wimax Loading commit data...
wireless Loading commit data...
x25 Loading commit data...
xdp Loading commit data...
xfrm Loading commit data...
Kconfig Loading commit data...
Makefile Loading commit data...
compat.c Loading commit data...
socket.c Loading commit data...
sysctl_net.c Loading commit data...