Commit 83fccfc3 authored Aug 13, 2015 by Eric Dumazet Committed by David S. Miller Aug 13, 2015

inet: fix potential deadlock in reqsk_queue_unlink()



When replacing del_timer() with del_timer_sync(), I introduced
a deadlock condition :

reqsk_queue_unlink() is called from inet_csk_reqsk_queue_drop()

inet_csk_reqsk_queue_drop() can be called from many contexts,
one being the timer handler itself (reqsk_timer_handler()).

In this case, del_timer_sync() loops forever.

Simple fix is to test if timer is pending.

Fixes: 2235f2ac ("inet: fix races with reqsk timers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 2a4eebf0

net/ipv4/inet_connection_sock.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -593,7 +593,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
		}

		spin_unlock(&queue->syn_wait_lock);
		if (del_timer_sync(&req->rsk_timer))
		if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
		reqsk_put(req);
		return found;
		}