Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b563e9bb authored by Xin Long's avatar Xin Long Committed by Greg Kroah-Hartman
Browse files

sctp: avoid running the sctp state machine recursively 



[ Upstream commit fbd019737d71e405f86549fd738f81e2ff3dd073 ]

Ying triggered a call trace when doing an asconf testing:

  BUG: scheduling while atomic: swapper/12/0/0x10000100
  Call Trace:
   <IRQ>  [<ffffffffa4375904>] dump_stack+0x19/0x1b
   [<ffffffffa436fcaf>] __schedule_bug+0x64/0x72
   [<ffffffffa437b93a>] __schedule+0x9ba/0xa00
   [<ffffffffa3cd5326>] __cond_resched+0x26/0x30
   [<ffffffffa437bc4a>] _cond_resched+0x3a/0x50
   [<ffffffffa3e22be8>] kmem_cache_alloc_node+0x38/0x200
   [<ffffffffa423512d>] __alloc_skb+0x5d/0x2d0
   [<ffffffffc0995320>] sctp_packet_transmit+0x610/0xa20 [sctp]
   [<ffffffffc098510e>] sctp_outq_flush+0x2ce/0xc00 [sctp]
   [<ffffffffc098646c>] sctp_outq_uncork+0x1c/0x20 [sctp]
   [<ffffffffc0977338>] sctp_cmd_interpreter.isra.22+0xc8/0x1460 [sctp]
   [<ffffffffc0976ad1>] sctp_do_sm+0xe1/0x350 [sctp]
   [<ffffffffc099443d>] sctp_primitive_ASCONF+0x3d/0x50 [sctp]
   [<ffffffffc0977384>] sctp_cmd_interpreter.isra.22+0x114/0x1460 [sctp]
   [<ffffffffc0976ad1>] sctp_do_sm+0xe1/0x350 [sctp]
   [<ffffffffc097b3a4>] sctp_assoc_bh_rcv+0xf4/0x1b0 [sctp]
   [<ffffffffc09840f1>] sctp_inq_push+0x51/0x70 [sctp]
   [<ffffffffc099732b>] sctp_rcv+0xa8b/0xbd0 [sctp]

As it shows, the first sctp_do_sm() running under atomic context (NET_RX
softirq) invoked sctp_primitive_ASCONF() that uses GFP_KERNEL flag later,
and this flag is supposed to be used in non-atomic context only. Besides,
sctp_do_sm() was called recursively, which is not expected.

Vlad tried to fix this recursive call in Commit c0786693 ("sctp: Fix
oops when sending queued ASCONF chunks") by introducing a new command
SCTP_CMD_SEND_NEXT_ASCONF. But it didn't work as this command is still
used in the first sctp_do_sm() call, and sctp_primitive_ASCONF() will
be called in this command again.

To avoid calling sctp_do_sm() recursively, we send the next queued ASCONF
not by sctp_primitive_ASCONF(), but by sctp_sf_do_prm_asconf() in the 1st
sctp_do_sm() directly.

Reported-by: default avatarYing Xu <yinxu@redhat.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fdd36abd

include/net/sctp/command.h

+0 −1
Original line number Original line Diff line number Diff line
@@ -105,7 +105,6 @@ enum sctp_verb { 
	SCTP_CMD_T1_RETRAN,	 /* Mark for retransmission after T1 timeout  */

	SCTP_CMD_T1_RETRAN,	 /* Mark for retransmission after T1 timeout  */

	SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */

	SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */

	SCTP_CMD_SEND_MSG,	 /* Send the whole use message */

	SCTP_CMD_SEND_MSG,	 /* Send the whole use message */

	SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */

	SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/

	SCTP_CMD_PURGE_ASCONF_QUEUE, /* Purge all asconf queues.*/

	SCTP_CMD_SET_ASOC,	 /* Restore association context */

	SCTP_CMD_SET_ASOC,	 /* Restore association context */

	SCTP_CMD_LAST

	SCTP_CMD_LAST

net/sctp/sm_sideeffect.c

+0 −29
Original line number Original line Diff line number Diff line
@@ -1112,32 +1112,6 @@ static void sctp_cmd_send_msg(struct sctp_association *asoc, 
}

}









/* Sent the next ASCONF packet currently stored in the association.

 * This happens after the ASCONF_ACK was succeffully processed.

 */

static void sctp_cmd_send_asconf(struct sctp_association *asoc)

{

	struct net *net = sock_net(asoc->base.sk);



	/* Send the next asconf chunk from the addip chunk

	 * queue.

	 */

	if (!list_empty(&asoc->addip_chunk_list)) {

		struct list_head *entry = asoc->addip_chunk_list.next;

		struct sctp_chunk *asconf = list_entry(entry,

						struct sctp_chunk, list);

		list_del_init(entry);



		/* Hold the chunk until an ASCONF_ACK is received. */

		sctp_chunk_hold(asconf);

		if (sctp_primitive_ASCONF(net, asoc, asconf))

			sctp_chunk_free(asconf);

		else

			asoc->addip_last_asconf = asconf;

	}

}





/* These three macros allow us to pull the debugging code out of the

/* These three macros allow us to pull the debugging code out of the

 * main flow of sctp_do_sm() to keep attention focused on the real

 * main flow of sctp_do_sm() to keep attention focused on the real

 * functionality there.

 * functionality there.
@@ -1783,9 +1757,6 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, 
			}

			}

			sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp);

			sctp_cmd_send_msg(asoc, cmd->obj.msg, gfp);

			break;

			break;

		case SCTP_CMD_SEND_NEXT_ASCONF:

			sctp_cmd_send_asconf(asoc);

			break;

		case SCTP_CMD_PURGE_ASCONF_QUEUE:

		case SCTP_CMD_PURGE_ASCONF_QUEUE:

			sctp_asconf_queue_teardown(asoc);

			sctp_asconf_queue_teardown(asoc);

			break;

			break;

net/sctp/sm_statefuns.c

+27 −8
Original line number Original line Diff line number Diff line
@@ -3824,6 +3824,29 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, 
	return SCTP_DISPOSITION_CONSUME;

	return SCTP_DISPOSITION_CONSUME;

}

}





static enum sctp_disposition sctp_send_next_asconf(

					struct net *net,

					const struct sctp_endpoint *ep,

					struct sctp_association *asoc,

					const union sctp_subtype type,

					struct sctp_cmd_seq *commands)

{

	struct sctp_chunk *asconf;

	struct list_head *entry;



	if (list_empty(&asoc->addip_chunk_list))

		return SCTP_DISPOSITION_CONSUME;



	entry = asoc->addip_chunk_list.next;

	asconf = list_entry(entry, struct sctp_chunk, list);



	list_del_init(entry);

	sctp_chunk_hold(asconf);

	asoc->addip_last_asconf = asconf;



	return sctp_sf_do_prm_asconf(net, ep, asoc, type, asconf, commands);

}



/*

/*

 * ADDIP Section 4.3 General rules for address manipulation

 * ADDIP Section 4.3 General rules for address manipulation

 * When building TLV parameters for the ASCONF Chunk that will add or

 * When building TLV parameters for the ASCONF Chunk that will add or
@@ -3915,14 +3938,10 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, 
				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));

				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));





		if (!sctp_process_asconf_ack((struct sctp_association *)asoc,

		if (!sctp_process_asconf_ack((struct sctp_association *)asoc,

					     asconf_ack)) {

					     asconf_ack))

			/* Successfully processed ASCONF_ACK.  We can

			return sctp_send_next_asconf(net, ep,

			 * release the next asconf if we have one.

					(struct sctp_association *)asoc,

			 */

							type, commands);

			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,

					SCTP_NULL());

			return SCTP_DISPOSITION_CONSUME;

		}





		abort = sctp_make_abort(asoc, asconf_ack,

		abort = sctp_make_abort(asoc, asconf_ack,

					sizeof(struct sctp_errhdr));

					sizeof(struct sctp_errhdr));