Paolo Abeni 26736a08ee tipc: don't call sock_release() in atomic context ... syzbot reported a scheduling while atomic issue at netns destruction time: BUG: sleeping function called from invalid context at net/core/sock.c:2769 in_atomic(): 1, irqs_disabled(): 0, pid: 85, name: kworker/u4:3 5 locks held by kworker/u4:3/85: #0: ((wq_completion)"%s""netns"){+.+.}, at: [<00000000c9792deb>] process_one_work+0xaaf/0x1af0 kernel/workqueue.c:2084 #1: (net_cleanup_work){+.+.}, at: [<00000000adc12e2a>] process_one_work+0xb01/0x1af0 kernel/workqueue.c:2088 #2: (net_sem){++++}, at: [<000000009ccb5669>] cleanup_net+0x23f/0xd20 net/core/net_namespace.c:494 #3: (net_mutex){+.+.}, at: [<00000000a92767d9>] cleanup_net+0xa7d/0xd20 net/core/net_namespace.c:496 #4: (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>] spin_lock_bh include/linux/spinlock.h:315 [inline] #4: (&(&srv->idr_lock)->rlock){+...}, at: [<000000001343e568>] tipc_topsrv_stop+0x231/0x610 net/tipc/topsrv.c:685 CPU: 0 PID: 85 Comm: kworker/u4:3 Not tainted 4.16.0-rc1+ #230 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6128 __might_sleep+0x95/0x190 kernel/sched/core.c:6081 lock_sock_nested+0x37/0x110 net/core/sock.c:2769 lock_sock include/net/sock.h:1463 [inline] tipc_release+0x103/0xff0 net/tipc/socket.c:572 sock_release+0x8d/0x1e0 net/socket.c:594 tipc_topsrv_stop+0x3c0/0x610 net/tipc/topsrv.c:696 tipc_exit_net+0x15/0x40 net/tipc/core.c:96 ops_exit_list.isra.6+0xae/0x150 net/core/net_namespace.c:148 cleanup_net+0x6ba/0xd20 net/core/net_namespace.c:529 process_one_work+0xbbf/0x1af0 kernel/workqueue.c:2113 worker_thread+0x223/0x1990 kernel/workqueue.c:2247 kthread+0x33c/0x400 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:429 This is caused by tipc_topsrv_stop() releasing the listener socket with the idr lock held. This changeset addresses the issue moving the release operation outside such lock. Reported-and-tested-by: syzbot+749d9d87c294c00ca856@syzkaller.appspotmail.com Fixes: 0ef897be12 ("tipc: separate topology server listener socket from subcsriber sockets") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Acked-by: ///jon Signed-off-by: David S. Miller <davem@davemloft.net>		2018-02-19 14:38:50 -05:00
..
addr.c
addr.h
bcast.c
bcast.h
bearer.c	tipc: apply bearer link tolerance on running links	2018-02-14 15:22:24 -05:00
bearer.h
core.c
core.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
discover.c
discover.h
eth_media.c
group.c	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
group.h
ib_media.c
Kconfig
link.c	tipc: apply bearer link tolerance on running links	2018-02-14 15:22:24 -05:00
link.h
Makefile	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
monitor.c
monitor.h
msg.c	tipc: fix skb truesize/datasize ratio control	2018-02-08 15:30:40 -05:00
msg.h
name_distr.c
name_distr.h
name_table.c	tipc: make struct tipc_server private for server.c	2018-02-16 15:26:34 -05:00
name_table.h	tipc: simplify endianness handling in topology subscriber	2018-02-16 15:26:33 -05:00
net.c
net.h
netlink.c
netlink.h
netlink_compat.c
node.c	tipc: apply bearer link tolerance on running links	2018-02-14 15:22:24 -05:00
node.h	tipc: apply bearer link tolerance on running links	2018-02-14 15:22:24 -05:00
socket.c	net: make getname() functions return length rather than use int* parameter	2018-02-12 14:15:04 -05:00
socket.h
subscr.c	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
subscr.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
sysctl.c
topsrv.c	tipc: don't call sock_release() in atomic context	2018-02-19 14:38:50 -05:00
topsrv.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
udp_media.c
udp_media.h