Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84cfc878 authored by Xin Long's avatar Xin Long Committed by Greg Kroah-Hartman
Browse files

sctp: not disable bh in the whole sctp_get_port_local() 



[ Upstream commit 3106ecb43a05dc3e009779764b9da245a5d082de ]

With disabling bh in the whole sctp_get_port_local(), when
snum == 0 and too many ports have been used, the do-while
loop will take the cpu for a long time and cause cpu stuck:

  [ ] watchdog: BUG: soft lockup - CPU#11 stuck for 22s!
  [ ] RIP: 0010:native_queued_spin_lock_slowpath+0x4de/0x940
  [ ] Call Trace:
  [ ]  _raw_spin_lock+0xc1/0xd0
  [ ]  sctp_get_port_local+0x527/0x650 [sctp]
  [ ]  sctp_do_bind+0x208/0x5e0 [sctp]
  [ ]  sctp_autobind+0x165/0x1e0 [sctp]
  [ ]  sctp_connect_new_asoc+0x355/0x480 [sctp]
  [ ]  __sctp_connect+0x360/0xb10 [sctp]

There's no need to disable bh in the whole function of
sctp_get_port_local. So fix this cpu stuck by removing
local_bh_disable() called at the beginning, and using
spin_lock_bh() instead.

The same thing was actually done for inet_csk_get_port() in
Commit ea8add2b ("tcp/dccp: better use of ephemeral
ports in bind()").

Thanks to Marcelo for pointing the buggy code out.

v1->v2:
  - use cond_resched() to yield cpu to other tasks if needed,
    as Eric noticed.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Reported-by: default avatarYing Xu <yinxu@redhat.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d2ece46d

net/sctp/socket.c

+6 −10
Original line number Diff line number Diff line
@@ -7643,8 +7643,6 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) 


	pr_debug("%s: begins, snum:%d\n", __func__, snum);



	local_bh_disable();



	if (snum == 0) {

		/* Search for an available port. */

		int low, high, remaining, index;
@@ -7663,20 +7661,21 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) 
				continue;

			index = sctp_phashfn(sock_net(sk), rover);

			head = &sctp_port_hashtable[index];

			spin_lock(&head->lock);

			spin_lock_bh(&head->lock);

			sctp_for_each_hentry(pp, &head->chain)

				if ((pp->port == rover) &&

				    net_eq(sock_net(sk), pp->net))

					goto next;

			break;

		next:

			spin_unlock(&head->lock);

			spin_unlock_bh(&head->lock);

			cond_resched();

		} while (--remaining > 0);



		/* Exhausted local port range during search? */

		ret = 1;

		if (remaining <= 0)

			goto fail;

			return ret;



		/* OK, here is the one we will use.  HEAD (the port

		 * hash table list entry) is non-NULL and we hold it's
@@ -7691,7 +7690,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) 
		 * port iterator, pp being NULL.

		 */

		head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];

		spin_lock(&head->lock);

		spin_lock_bh(&head->lock);

		sctp_for_each_hentry(pp, &head->chain) {

			if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))

				goto pp_found;
@@ -7773,10 +7772,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) 
	ret = 0;



fail_unlock:

	spin_unlock(&head->lock);



fail:

	local_bh_enable();

	spin_unlock_bh(&head->lock);

	return ret;

}