Revision 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 authored by Fabio M. De Francesco on 23 February 2022, 10:02:52 UTC, committed by Jakub Kicinski on 24 February 2022, 17:09:33 UTC
smc_pnetid_by_table_ib() uses read_lock() and then it calls smc_pnet_apply_ib()
which, in turn, calls mutex_lock(&smc_ib_devices.mutex).
read_lock() disables preemption. Therefore, the code acquires a mutex while in
atomic context and it leads to a SAC bug.
Fix this bug by replacing the rwlock with a mutex.
Reported-and-tested-by: syzbot+4f322a6d84e991c38775@syzkaller.appspotmail.com
Fixes: 64e28b52c7a6 ("net/smc: add pnet table namespace support")
Confirmed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
Acked-by: Karsten Graul <kgraul@linux.ibm.com>
Link: https://lore.kernel.org/r/20220223100252.22562-1-fmdefrancesco@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent e13ad14
| File | Mode | Size |
|---|---|---|
| Makefile | -rw-r--r-- | 1.5 KB |
| bpf_sk_storage.c | -rw-r--r-- | 23.1 KB |
| datagram.c | -rw-r--r-- | 20.6 KB |
| datagram.h | -rw-r--r-- | 322 bytes |
| dev.c | -rw-r--r-- | 275.4 KB |
| dev_addr_lists.c | -rw-r--r-- | 26.5 KB |
| dev_addr_lists_test.c | -rw-r--r-- | 6.0 KB |
| dev_ioctl.c | -rw-r--r-- | 13.9 KB |
| devlink.c | -rw-r--r-- | 295.6 KB |
| drop_monitor.c | -rw-r--r-- | 41.3 KB |
| dst.c | -rw-r--r-- | 8.7 KB |
| dst_cache.c | -rw-r--r-- | 3.9 KB |
| failover.c | -rw-r--r-- | 7.5 KB |
| fib_notifier.c | -rw-r--r-- | 4.8 KB |
| fib_rules.c | -rw-r--r-- | 31.1 KB |
| filter.c | -rw-r--r-- | 293.6 KB |
| flow_dissector.c | -rw-r--r-- | 49.1 KB |
| flow_offload.c | -rw-r--r-- | 15.2 KB |
| gen_estimator.c | -rw-r--r-- | 7.3 KB |
| gen_stats.c | -rw-r--r-- | 13.2 KB |
| gro.c | -rw-r--r-- | 19.1 KB |
| gro_cells.c | -rw-r--r-- | 2.3 KB |
| hwbm.c | -rw-r--r-- | 1.9 KB |
| link_watch.c | -rw-r--r-- | 6.1 KB |
| lwt_bpf.c | -rw-r--r-- | 14.8 KB |
| lwtunnel.c | -rw-r--r-- | 9.1 KB |
| neighbour.c | -rw-r--r-- | 95.2 KB |
| net-procfs.c | -rw-r--r-- | 9.3 KB |
| net-sysfs.c | -rw-r--r-- | 48.5 KB |
| net-sysfs.h | -rw-r--r-- | 510 bytes |
| net-traces.c | -rw-r--r-- | 1.7 KB |
| net_namespace.c | -rw-r--r-- | 32.4 KB |
| netclassid_cgroup.c | -rw-r--r-- | 3.2 KB |
| netevent.c | -rw-r--r-- | 1.8 KB |
| netpoll.c | -rw-r--r-- | 19.3 KB |
| netprio_cgroup.c | -rw-r--r-- | 6.4 KB |
| of_net.c | -rw-r--r-- | 4.5 KB |
| page_pool.c | -rw-r--r-- | 19.9 KB |
| pktgen.c | -rw-r--r-- | 99.2 KB |
| ptp_classifier.c | -rw-r--r-- | 7.4 KB |
| request_sock.c | -rw-r--r-- | 5.0 KB |
| rtnetlink.c | -rw-r--r-- | 137.9 KB |
| scm.c | -rw-r--r-- | 8.5 KB |
| secure_seq.c | -rw-r--r-- | 4.9 KB |
| selftests.c | -rw-r--r-- | 9.0 KB |
| skbuff.c | -rw-r--r-- | 159.9 KB |
| skmsg.c | -rw-r--r-- | 28.3 KB |
| sock.c | -rw-r--r-- | 93.4 KB |
| sock_destructor.h | -rw-r--r-- | 362 bytes |
| sock_diag.c | -rw-r--r-- | 7.8 KB |
| sock_map.c | -rw-r--r-- | 37.5 KB |
| sock_reuseport.c | -rw-r--r-- | 16.5 KB |
| stream.c | -rw-r--r-- | 5.3 KB |
| sysctl_net_core.c | -rw-r--r-- | 15.4 KB |
| timestamping.c | -rw-r--r-- | 1.5 KB |
| tso.c | -rw-r--r-- | 2.6 KB |
| utils.c | -rw-r--r-- | 11.6 KB |
| xdp.c | -rw-r--r-- | 15.2 KB |
Computing file changes ...
