TencentOS-kernel/net/rxrpc
David Howells b611f66ccf rxrpc: Fix deadlock around release of dst cached on udp tunnel
[ Upstream commit 5399d52233c47905bbf97dcbaa2d7a9cc31670ba ]

AF_RXRPC sockets use UDP ports in encap mode.  This causes socket and dst
from an incoming packet to get stolen and attached to the UDP socket from
whence it is leaked when that socket is closed.

When a network namespace is removed, the wait for dst records to be cleaned
up happens before the cleanup of the rxrpc and UDP socket, meaning that the
wait never finishes.

Fix this by moving the rxrpc (and, by dependence, the afs) private
per-network namespace registrations to the device group rather than subsys
group.  This allows cached rxrpc local endpoints to be cleared and their
UDP sockets closed before we try waiting for the dst records.

The symptom is that lines looking like the following:

	unregister_netdevice: waiting for lo to become free

get emitted at regular intervals after running something like the
referenced syzbot test.

Thanks to Vadim for tracking this down and work out the fix.

Reported-by: syzbot+df400f2f24a1677cd7e0@syzkaller.appspotmail.com
Reported-by: Vadim Fedorenko <vfedorenko@novek.ru>
Fixes: 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook")
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Vadim Fedorenko <vfedorenko@novek.ru>
Link: https://lore.kernel.org/r/161196443016.3868642.5577440140646403533.stgit@warthog.procyon.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-12 12:51:53 +08:00
..
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
af_rxrpc.c rxrpc: Fix deadlock around release of dst cached on udp tunnel 2021-04-12 12:51:53 +08:00
ar-internal.h rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
call_accept.c rxrpc: Fix memory leak in rxrpc_lookup_local 2021-04-12 12:51:48 +08:00
call_event.c rxrpc: Fix afs large storage transmission performance drop 2021-03-16 16:31:17 +08:00
call_object.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2021-03-16 16:33:09 +08:00
conn_client.c rxrpc: Fix call interruptibility handling 2021-03-16 16:25:53 +08:00
conn_event.c rxrpc: Fix some missing _bh annotations on locking conn->state_lock 2021-03-16 16:38:05 +08:00
conn_object.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2021-03-16 16:33:09 +08:00
conn_service.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
input.c rxrpc: Call state should be read with READ_ONCE() under some circumstances 2021-04-12 12:51:30 +08:00
insecure.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
key.c rxrpc: Fix handling of an unsupported token type in rxrpc_read() 2021-04-12 12:51:31 +08:00
local_event.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
local_object.c rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket 2021-03-16 16:27:08 +08:00
misc.c rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
net_ns.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
output.c rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
peer_event.c rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
peer_object.c rxrpc: Make rxrpc_kernel_get_srtt() indicate validity 2021-03-16 16:35:28 +08:00
proc.c rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not user_ID 2021-03-16 16:30:27 +08:00
protocol.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
recvmsg.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2021-03-16 16:33:09 +08:00
rtt.c rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
rxkad.c rxrpc: Fix a memory leak in rxkad_verify_response() 2021-03-16 16:28:20 +08:00
security.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sendmsg.c rxrpc: Fix race between recvmsg and sendmsg on immediate call failure 2021-03-16 16:33:09 +08:00
skbuff.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sysctl.c rxrpc: Fix the excessive initial retransmission timeout 2021-03-16 16:28:20 +08:00
utils.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00