From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Michal Kubecek <mkubecek@suse.cz>
Cc: Sasha Levin <sashal@kernel.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Firo Yang <firo.yang@suse.com>,
Jakub Kicinski <jakub.kicinski@netronome.com>,
rcu@vger.kernel.org, netdev@vger.kernel.org,
lkft-triage@lists.linaro.org,
Naresh Kamboju <naresh.kamboju@linaro.org>
Subject: Re: [PATCH stable-4.19] tcp/dccp: fix possible race __inet_lookup_established()
Date: Thu, 2 Jan 2020 22:48:19 +0100 [thread overview]
Message-ID: <20200102214819.GA745235@kroah.com> (raw)
In-Reply-To: <20200102212844.0D734E0095@unicorn.suse.cz>
On Thu, Jan 02, 2020 at 10:28:44PM +0100, Michal Kubecek wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> [ Upstream commit 8dbd76e79a16b45b2ccb01d2f2e08dbf64e71e40 ]
>
> Michal Kubecek and Firo Yang did a very nice analysis of crashes
> happening in __inet_lookup_established().
>
> Since a TCP socket can go from TCP_ESTABLISH to TCP_LISTEN
> (via a close()/socket()/listen() cycle) without a RCU grace period,
> I should not have changed listeners linkage in their hash table.
>
> They must use the nulls protocol (Documentation/RCU/rculist_nulls.txt),
> so that a lookup can detect a socket in a hash list was moved in
> another one.
>
> Since we added code in commit d296ba60d8e2 ("soreuseport: Resolve
> merge conflict for v4/v6 ordering fix"), we have to add
> hlist_nulls_add_tail_rcu() helper.
>
> stable-4.19: we also need to update code in __inet_lookup_listener() and
> inet6_lookup_listener() which has been removed in 5.0-rc1.
>
> Fixes: 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: Michal Kubecek <mkubecek@suse.cz>
> Reported-by: Firo Yang <firo.yang@suse.com>
> Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
> Link: https://lore.kernel.org/netdev/20191120083919.GH27852@unicorn.suse.cz/
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Thanks for the updated patches, all now queued up.
greg k-h
next prev parent reply other threads:[~2020-01-02 21:48 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-02 6:54 stable-rc-4.19.93-rc1/4e040169e8b7 : kernel panic RIP: 0010:__inet_lookup_listener Naresh Kamboju
2020-01-02 7:55 ` Naresh Kamboju
2020-01-02 9:26 ` Michal Kubecek
2020-01-02 9:59 ` Eric Dumazet
2020-01-02 13:23 ` Michal Kubecek
2020-01-02 15:38 ` Greg Kroah-Hartman
2020-01-02 21:28 ` [PATCH stable-4.19] tcp/dccp: fix possible race __inet_lookup_established() Michal Kubecek
2020-01-02 21:48 ` Greg Kroah-Hartman [this message]
2020-01-02 21:28 ` [PATCH stable-4.14] " Michal Kubecek
2020-01-02 21:28 ` [PATCH stable-4.9] " Michal Kubecek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200102214819.GA745235@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=firo.yang@suse.com \
--cc=jakub.kicinski@netronome.com \
--cc=lkft-triage@lists.linaro.org \
--cc=mkubecek@suse.cz \
--cc=naresh.kamboju@linaro.org \
--cc=netdev@vger.kernel.org \
--cc=rcu@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.