Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1626276

[PATCH 4.4 44/45] sctp: deny peeloff operation on asocs with threads sleeping on it

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>

commit dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 upstream.

commit 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf")
attempted to avoid a BUG_ON call when the association being used for a
sendmsg() is blocked waiting for more sndbuf and another thread did a
peeloff operation on such asoc, moving it to another socket.

As Ben Hutchings noticed, then in such case it would return without
locking back the socket and would cause two unlocks in a row.

Further analysis also revealed that it could allow a double free if the
application managed to peeloff the asoc that is created during the
sendmsg call, because then sctp_sendmsg() would try to free the asoc
that was created only for that call.

This patch takes another approach. It will deny the peeloff operation
if there is a thread sleeping on the asoc, so this situation doesn't
exist anymore. This avoids the issues described above and also honors
the syscalls that are already being handled (it can be multiple sendmsg
calls).

Joint work with Xin Long.

Fixes: 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf")
Cc: Alexander Popov <alex.popov@linux.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sctp/socket.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4422,6 +4422,12 @@ int sctp_do_peeloff(struct sock *sk, sct
 	if (!asoc)
 		return -EINVAL;
 
+	/* If there is a thread waiting on more sndbuf space for
+	 * sending on this asoc, it cannot be peeled.
+	 */
+	if (waitqueue_active(&asoc->wait))
+		return -EBUSY;
+
 	/* An association cannot be branched off from an already peeled-off
 	 * socket, nor is this supported for tcp style sockets.
 	 */
@@ -6960,8 +6966,6 @@ static int sctp_wait_for_sndbuf(struct s
 		 */
 		release_sock(sk);
 		current_timeo = schedule_timeout(current_timeo);
-		if (sk != asoc->base.sk)
-			goto do_error;
 		lock_sock(sk);
 
 		*timeo_p = current_timeo;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/45] 4.4.63-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 44/45] sctp: deny peeloff operation on asocs with threads sleeping on it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 32/45] mm: Tighten x86 /dev/mem with zeroing reads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
  [PATCH 4.4 16/45] xen, fbfront: fix connecting to backend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 15/45] scsi: sd: Fix capacity calculation with 32-bit sector_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 27/45] ath9k: fix NULL pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 20/45] char: Drop bogus dependency of DEVPORT on !M68K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 11/45] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 23/45] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 12/45] iscsi-target: Drop work-around for legacy GlobalSAN initiator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 10/45] acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 14/45] scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 03/45] drm/nouveau/mpeg: mthd returns true on success now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 06/45] Input: xpad - add support for Razer Wildcat gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 39/45] catc: Use heap buffer for memory size test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 25/45] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 07/45] perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 41/45] SUNRPC: fix refcounting problems with auth_gss messages. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 02/45] thp: fix MADV_DONTNEED vs clear soft dirty race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 31/45] rtc: tegra: Implement clock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 17/45] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 05/45] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 08/45] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 40/45] ibmveth: calculate gso_segs for large packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 21/45] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 42/45] tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 38/45] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 26/45] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  [PATCH 4.4 01/45] cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:10 +0200
  Re: [PATCH 4.4 00/45] 4.4.63-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-19 22:40 +0200
  Re: [PATCH 4.4 00/45] 4.4.63-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-20 01:30 +0200

csiph-web