Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1327339 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2016-02-05 00:20 +0100 |
| Last post | 2016-02-05 00:20 +0100 |
| Articles | 2 — 1 participant |
Back to article view | Back to linux.kernel
[4.2.y-ckt stable] Linux 4.2.8-ckt4 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-05 00:20 +0100
[PATCH 4.2.y-ckt 03/64] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Kamal Mostafa <kamal@canonical.com> - 2016-02-05 00:20 +0100
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-05 00:20 +0100 |
| Subject | [4.2.y-ckt stable] Linux 4.2.8-ckt4 stable review |
| Message-ID | <qYASS-8lI-3@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 4.2.8-ckt4 stable
kernel.
This version contains 64 new patches, summarized below. The new patches
are posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-4.2.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-4.2.y-review
The review period for version 4.2.8-ckt4 will be open for the next three
days. To report a problem, please reply to the relevant follow-up patch
message.
For more information about the Linux 4.2.y-ckt extended stable kernel
series, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Kamal
--
Documentation/DMA-API.txt | 7 ++++
arch/arm64/Makefile | 1 +
arch/arm64/kernel/head.S | 5 +++
arch/arm64/mm/mmu.c | 12 +++----
arch/arm64/mm/pageattr.c | 3 ++
arch/arm64/mm/proc-macros.S | 12 +++++++
arch/arm64/mm/proc.S | 4 +--
arch/powerpc/kernel/eeh_pe.c | 33 ++++++++----------
arch/powerpc/kernel/misc_64.S | 28 ---------------
arch/powerpc/kernel/module_64.c | 12 +++++--
arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +-
arch/powerpc/kvm/powerpc.c | 20 +++++------
arch/powerpc/perf/power8-pmu.c | 2 +-
arch/x86/include/asm/pgtable_types.h | 6 ++--
arch/x86/kernel/apic/io_apic.c | 6 +++-
arch/x86/mm/pageattr.c | 4 +--
drivers/acpi/video_detect.c | 8 -----
drivers/cpufreq/cpufreq_governor.c | 11 ++++--
drivers/cpufreq/pxa2xx-cpufreq.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 ++--
drivers/gpu/drm/amd/amdgpu/tonga_dpm.c | 17 ++-------
drivers/gpu/drm/radeon/dce6_afmt.c | 12 ++-----
drivers/gpu/drm/radeon/evergreen_hdmi.c | 10 ++++++
drivers/gpu/drm/radeon/evergreend.h | 5 +++
drivers/gpu/drm/radeon/radeon.h | 2 +-
drivers/gpu/drm/radeon/radeon_atombios.c | 49 +++++++++++++++++++-------
drivers/gpu/drm/radeon/radeon_audio.c | 20 +++++++----
drivers/gpu/drm/radeon/radeon_audio.h | 1 +
drivers/gpu/drm/radeon/vce_v1_0.c | 12 +++----
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 7 ++++
drivers/hwmon/dell-smm-hwmon.c | 11 ++++++
drivers/iio/imu/adis_buffer.c | 2 +-
drivers/irqchip/irq-atmel-aic-common.c | 2 +-
drivers/net/xen-netback/netback.c | 7 ++--
drivers/net/xen-netfront.c | 21 +++++++-----
drivers/pci/hotplug/acpiphp_glue.c | 4 ++-
drivers/scsi/sd.c | 7 ++--
drivers/scsi/sr.c | 4 +++
drivers/staging/speakup/selection.c | 5 ++-
drivers/staging/speakup/serialio.c | 13 ++++++-
drivers/tty/n_tty.c | 7 ++--
drivers/tty/serial/8250/8250_pci.c | 29 ++++++++++++++++
drivers/tty/tty_io.c | 24 ++++++++++++-
drivers/usb/class/cdc-acm.c | 14 +++++++-
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/core/hub.c | 8 +++--
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 1 +
drivers/usb/serial/option.c | 18 +++++++++-
drivers/usb/serial/visor.c | 11 ++++--
drivers/virtio/virtio_pci_common.c | 2 ++
fs/timerfd.c | 2 +-
include/linux/dmapool.h | 6 ++++
include/linux/hrtimer.h | 34 ++++++++++++++++--
kernel/seccomp.c | 22 ++++++------
kernel/time/hrtimer.c | 55 ++++++++++++++++++++----------
kernel/time/itimer.c | 2 +-
kernel/time/posix-timers.c | 2 +-
kernel/time/tick-sched.c | 4 +--
kernel/time/timer_list.c | 2 +-
net/sctp/sm_sideeffect.c | 42 ++++++++++++-----------
scripts/mod/modpost.c | 3 +-
sound/core/compress_offload.c | 11 ++++++
sound/core/seq/oss/seq_oss_init.c | 2 +-
sound/core/seq/oss/seq_oss_synth.c | 2 +-
sound/drivers/dummy.c | 2 +-
sound/firewire/bebob/bebob_stream.c | 14 +++++---
sound/usb/quirks.c | 14 +++++++-
tools/perf/ui/browsers/annotate.c | 4 +--
tools/perf/util/hist.c | 2 ++
tools/perf/util/session.c | 2 +-
73 files changed, 497 insertions(+), 246 deletions(-)
Alan Modra (1):
powerpc: Simplify module TOC handling
Alan Stern (1):
SCSI: fix crashes in sd and sr runtime PM
Alex Deucher (2):
drm/amdgpu: fix tonga smu resume
drm/radeon: properly byte swap vce firmware setup
Arnd Bergmann (1):
cpufreq: pxa2xx: fix pxa_cpufreq_change_voltage prototype
Christian König (1):
drm/amdgpu: fix amdgpu_bo_pin_restricted VRAM placing v2
Daniele Palmas (1):
USB: serial: option: Adding support for Telit LE922
Du, Changbin (1):
usb: hub: do not clear BOS field during reset device
Gavin Shan (1):
powerpc/eeh: Fix PE location code
Greg Kroah-Hartman (1):
USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
Greg Kurz (1):
KVM: PPC: Fix ONE_REG AltiVec support
Guillaume Fougnies (1):
ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
Hans de Goede (1):
ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist"
Insu Yun (1):
ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot()
Jan Beulich (1):
x86/mm: Fix types used in pgprot cacheability flags translations
Jann Horn (1):
seccomp: always propagate NO_NEW_PRIVS on tsync
Jiri Olsa (1):
perf hists: Fix HISTC_MEM_DCACHELINE width setting
Joe Jin (1):
xen-netfront: update num_queues to real created
Johan Hovold (1):
USB: visor: fix null-deref at probe
John Ernberg (1):
USB: option: fix Cinterion AHxx enumeration
Kamal Mostafa (1):
[4.2-stable only] Revert "arm64: mm: use correct mapping granularity under DEBUG_RODATA"
Karl Heiss (1):
sctp: Prevent soft lockup when sctp_accept() is called during a timeout event
Lars-Peter Clausen (1):
iio: adis_buffer: Fix out-of-bounds memory access
Lorenzo Pieralisi (1):
arm64: kernel: fix architected PMU registers unconditional access
Lu Baolu (2):
usb: cdc-acm: handle unlinked urb in acm read callback
usb: cdc-acm: send zero packet for intel 7260 modem
Lucas Tanure (1):
ALSA: bebob: Use a signed return type for get_formation_index
Madhavan Srinivasan (1):
powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
Markus Trippelsdorf (1):
perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
Matt Fleming (1):
x86/mm/pat: Avoid truncation when converting cpa->numpages to address
Michael S. Tsirkin (1):
virtio_pci: fix use after free on release
Michel Dänzer (1):
drm/amdgpu: Use drm_calloc_large for VM page_tables array
Mika Penttilä (1):
arm64: mm: avoid calling apply_to_page_range on empty range
Mika Westerberg (1):
serial: 8250_pci: Add Intel Broadwell ports
Milo Kim (1):
irqchip/atmel-aic: Fix wrong bit operation for IRQ priority
Oliver Neukum (1):
cdc-acm:exclude Samsung phone 04e8:685d
Peter Dedecker (1):
USB: cp210x: add ID for IAI USB to RS485 adaptor
Peter Hurley (3):
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
n_tty: Fix unsafe reference to "other" ldisc
staging/speakup: Use tty_ldisc_ref() for paste kworker
Ravi Bangoria (1):
perf kvm record/report: 'unprocessable sample' error while recording/reporting guest data
Rob Clark (1):
drm/vmwgfx: respect 'nomodeset'
Samuel Thibault (1):
Staging: speakup: Fix getting port information
Sean O. Stalley (1):
mm: add dma_pool_zalloc() call to DMA API
Slava Grigorev (3):
drm/radeon: cleaned up VCO output settings for DP audio
drm/radeon: Add a common function for DFS handling
drm/radeon: fix DP audio support for APU with DCE4.1 display engine
Takashi Iwai (4):
ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
ALSA: seq: Degrade the error message for too many opens
ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
ALSA: dummy: Disable switching timer backend via sysfs
Thomas Gleixner (5):
x86/irq: Call chip->irq_set_affinity in proper context
hrtimer: Handle remaining time proper for TIME_LOW_RES
timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper
posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper
itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper
Thomas Huth (1):
KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
Thorsten Leemhuis (1):
hwmon: (dell-smm) Blacklist Dell Studio XPS 8000
Viresh Kumar (1):
cpufreq: Fix NULL reference crash while accessing policy->governor_data
Vladis Dronov (1):
USB: serial: visor: fix crash on detecting device without write_urbs
Wanpeng Li (1):
tick/nohz: Set the correct expiry when switching to nohz/lowres mode
Wei Liu (2):
xen-netback: respect user provided max_queues
xen-netfront: respect user provided max_queues
dann frazier (1):
arm64: errata: Add -mpc-relative-literal-loads to build flags
[toc] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-05 00:20 +0100 |
| Subject | [PATCH 4.2.y-ckt 03/64] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event |
| Message-ID | <qYBlU-lJ-29@gated-at.bofh.it> |
| In reply to | #1327339 |
4.2.8-ckt4 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Karl Heiss <kheiss@gmail.com>
[ Upstream commit 635682a14427d241bab7bbdeebb48a7d7b91638e ]
A case can occur when sctp_accept() is called by the user during
a heartbeat timeout event after the 4-way handshake. Since
sctp_assoc_migrate() changes both assoc->base.sk and assoc->ep, the
bh_sock_lock in sctp_generate_heartbeat_event() will be taken with
the listening socket but released with the new association socket.
The result is a deadlock on any future attempts to take the listening
socket lock.
Note that this race can occur with other SCTP timeouts that take
the bh_lock_sock() in the event sctp_accept() is called.
BUG: soft lockup - CPU#9 stuck for 67s! [swapper:0]
...
RIP: 0010:[<ffffffff8152d48e>] [<ffffffff8152d48e>] _spin_lock+0x1e/0x30
RSP: 0018:ffff880028323b20 EFLAGS: 00000206
RAX: 0000000000000002 RBX: ffff880028323b20 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff880028323be0 RDI: ffff8804632c4b48
RBP: ffffffff8100bb93 R08: 0000000000000000 R09: 0000000000000000
R10: ffff880610662280 R11: 0000000000000100 R12: ffff880028323aa0
R13: ffff8804383c3880 R14: ffff880028323a90 R15: ffffffff81534225
FS: 0000000000000000(0000) GS:ffff880028320000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00000000006df528 CR3: 0000000001a85000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process swapper (pid: 0, threadinfo ffff880616b70000, task ffff880616b6cab0)
Stack:
ffff880028323c40 ffffffffa01c2582 ffff880614cfb020 0000000000000000
<d> 0100000000000000 00000014383a6c44 ffff8804383c3880 ffff880614e93c00
<d> ffff880614e93c00 0000000000000000 ffff8804632c4b00 ffff8804383c38b8
Call Trace:
<IRQ>
[<ffffffffa01c2582>] ? sctp_rcv+0x492/0xa10 [sctp]
[<ffffffff8148c559>] ? nf_iterate+0x69/0xb0
[<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0
[<ffffffff8148c716>] ? nf_hook_slow+0x76/0x120
[<ffffffff814974a0>] ? ip_local_deliver_finish+0x0/0x2d0
[<ffffffff8149757d>] ? ip_local_deliver_finish+0xdd/0x2d0
[<ffffffff81497808>] ? ip_local_deliver+0x98/0xa0
[<ffffffff81496ccd>] ? ip_rcv_finish+0x12d/0x440
[<ffffffff81497255>] ? ip_rcv+0x275/0x350
[<ffffffff8145cfeb>] ? __netif_receive_skb+0x4ab/0x750
...
With lockdep debugging:
=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
CslRx/12087 is trying to release lock (slock-AF_INET) at:
[<ffffffffa01bcae0>] sctp_generate_timeout_event+0x40/0xe0 [sctp]
but there are no more locks to release!
other info that might help us debug this:
2 locks held by CslRx/12087:
#0: (&asoc->timers[i]){+.-...}, at: [<ffffffff8108ce1f>] run_timer_softirq+0x16f/0x3e0
#1: (slock-AF_INET){+.-...}, at: [<ffffffffa01bcac3>] sctp_generate_timeout_event+0x23/0xe0 [sctp]
Ensure the socket taken is also the same one that is released by
saving a copy of the socket before entering the timeout event
critical section.
Signed-off-by: Karl Heiss <kheiss@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/sctp/sm_sideeffect.c | 42 +++++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 19 deletions(-)
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 85e6f03..9366510 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -244,12 +244,13 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
int error;
struct sctp_transport *transport = (struct sctp_transport *) peer;
struct sctp_association *asoc = transport->asoc;
- struct net *net = sock_net(asoc->base.sk);
+ struct sock *sk = asoc->base.sk;
+ struct net *net = sock_net(sk);
/* Check whether a task is in the sock. */
- bh_lock_sock(asoc->base.sk);
- if (sock_owned_by_user(asoc->base.sk)) {
+ bh_lock_sock(sk);
+ if (sock_owned_by_user(sk)) {
pr_debug("%s: sock is busy\n", __func__);
/* Try again later. */
@@ -272,10 +273,10 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
transport, GFP_ATOMIC);
if (error)
- asoc->base.sk->sk_err = -error;
+ sk->sk_err = -error;
out_unlock:
- bh_unlock_sock(asoc->base.sk);
+ bh_unlock_sock(sk);
sctp_transport_put(transport);
}
@@ -285,11 +286,12 @@ out_unlock:
static void sctp_generate_timeout_event(struct sctp_association *asoc,
sctp_event_timeout_t timeout_type)
{
- struct net *net = sock_net(asoc->base.sk);
+ struct sock *sk = asoc->base.sk;
+ struct net *net = sock_net(sk);
int error = 0;
- bh_lock_sock(asoc->base.sk);
- if (sock_owned_by_user(asoc->base.sk)) {
+ bh_lock_sock(sk);
+ if (sock_owned_by_user(sk)) {
pr_debug("%s: sock is busy: timer %d\n", __func__,
timeout_type);
@@ -312,10 +314,10 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
(void *)timeout_type, GFP_ATOMIC);
if (error)
- asoc->base.sk->sk_err = -error;
+ sk->sk_err = -error;
out_unlock:
- bh_unlock_sock(asoc->base.sk);
+ bh_unlock_sock(sk);
sctp_association_put(asoc);
}
@@ -365,10 +367,11 @@ void sctp_generate_heartbeat_event(unsigned long data)
int error = 0;
struct sctp_transport *transport = (struct sctp_transport *) data;
struct sctp_association *asoc = transport->asoc;
- struct net *net = sock_net(asoc->base.sk);
+ struct sock *sk = asoc->base.sk;
+ struct net *net = sock_net(sk);
- bh_lock_sock(asoc->base.sk);
- if (sock_owned_by_user(asoc->base.sk)) {
+ bh_lock_sock(sk);
+ if (sock_owned_by_user(sk)) {
pr_debug("%s: sock is busy\n", __func__);
/* Try again later. */
@@ -389,10 +392,10 @@ void sctp_generate_heartbeat_event(unsigned long data)
transport, GFP_ATOMIC);
if (error)
- asoc->base.sk->sk_err = -error;
+ sk->sk_err = -error;
out_unlock:
- bh_unlock_sock(asoc->base.sk);
+ bh_unlock_sock(sk);
sctp_transport_put(transport);
}
@@ -403,10 +406,11 @@ void sctp_generate_proto_unreach_event(unsigned long data)
{
struct sctp_transport *transport = (struct sctp_transport *) data;
struct sctp_association *asoc = transport->asoc;
- struct net *net = sock_net(asoc->base.sk);
+ struct sock *sk = asoc->base.sk;
+ struct net *net = sock_net(sk);
- bh_lock_sock(asoc->base.sk);
- if (sock_owned_by_user(asoc->base.sk)) {
+ bh_lock_sock(sk);
+ if (sock_owned_by_user(sk)) {
pr_debug("%s: sock is busy\n", __func__);
/* Try again later. */
@@ -427,7 +431,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
out_unlock:
- bh_unlock_sock(asoc->base.sk);
+ bh_unlock_sock(sk);
sctp_association_put(asoc);
}
--
1.9.1
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web