Skip to content

Commit

Permalink
rxrpc: Fix deadlock around release of dst cached on udp tunnel
Browse files Browse the repository at this point in the history
AF_RXRPC sockets use UDP ports in encap mode.  This causes socket and dst
from an incoming packet to get stolen and attached to the UDP socket from
whence it is leaked when that socket is closed.

When a network namespace is removed, the wait for dst records to be cleaned
up happens before the cleanup of the rxrpc and UDP socket, meaning that the
wait never finishes.

Fix this by moving the rxrpc (and, by dependence, the afs) private
per-network namespace registrations to the device group rather than subsys
group.  This allows cached rxrpc local endpoints to be cleared and their
UDP sockets closed before we try waiting for the dst records.

The symptom is that lines looking like the following:

	unregister_netdevice: waiting for lo to become free

get emitted at regular intervals after running something like the
referenced syzbot test.

Thanks to Vadim for tracking this down and work out the fix.

Reported-by: syzbot+df400f2f24a1677cd7e0@syzkaller.appspotmail.com
Reported-by: Vadim Fedorenko <vfedorenko@novek.ru>
Fixes: 5271953 ("rxrpc: Use the UDP encap_rcv hook")
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Vadim Fedorenko <vfedorenko@novek.ru>
Link: https://lore.kernel.org/r/161196443016.3868642.5577440140646403533.stgit@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  • Loading branch information
dhowells authored and kuba-moo committed Jan 30, 2021
1 parent 8d520b4 commit 5399d52
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 6 deletions.
6 changes: 3 additions & 3 deletions fs/afs/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,7 @@ static int __init afs_init(void)
goto error_cache;
#endif

ret = register_pernet_subsys(&afs_net_ops);
ret = register_pernet_device(&afs_net_ops);
if (ret < 0)
goto error_net;

Expand All @@ -213,7 +213,7 @@ static int __init afs_init(void)
error_proc:
afs_fs_exit();
error_fs:
unregister_pernet_subsys(&afs_net_ops);
unregister_pernet_device(&afs_net_ops);
error_net:
#ifdef CONFIG_AFS_FSCACHE
fscache_unregister_netfs(&afs_cache_netfs);
Expand Down Expand Up @@ -244,7 +244,7 @@ static void __exit afs_exit(void)

proc_remove(afs_proc_symlink);
afs_fs_exit();
unregister_pernet_subsys(&afs_net_ops);
unregister_pernet_device(&afs_net_ops);
#ifdef CONFIG_AFS_FSCACHE
fscache_unregister_netfs(&afs_cache_netfs);
#endif
Expand Down
6 changes: 3 additions & 3 deletions net/rxrpc/af_rxrpc.c
Original file line number Diff line number Diff line change
Expand Up @@ -990,7 +990,7 @@ static int __init af_rxrpc_init(void)
goto error_security;
}

ret = register_pernet_subsys(&rxrpc_net_ops);
ret = register_pernet_device(&rxrpc_net_ops);
if (ret)
goto error_pernet;

Expand Down Expand Up @@ -1035,7 +1035,7 @@ static int __init af_rxrpc_init(void)
error_sock:
proto_unregister(&rxrpc_proto);
error_proto:
unregister_pernet_subsys(&rxrpc_net_ops);
unregister_pernet_device(&rxrpc_net_ops);
error_pernet:
rxrpc_exit_security();
error_security:
Expand All @@ -1057,7 +1057,7 @@ static void __exit af_rxrpc_exit(void)
unregister_key_type(&key_type_rxrpc);
sock_unregister(PF_RXRPC);
proto_unregister(&rxrpc_proto);
unregister_pernet_subsys(&rxrpc_net_ops);
unregister_pernet_device(&rxrpc_net_ops);
ASSERTCMP(atomic_read(&rxrpc_n_tx_skbs), ==, 0);
ASSERTCMP(atomic_read(&rxrpc_n_rx_skbs), ==, 0);

Expand Down

0 comments on commit 5399d52

Please sign in to comment.