From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Breno Leitao <leitao@debian.org>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.15 014/115] tcp: tcp_make_synack() can be called from process context
Date: Mon, 20 Mar 2023 15:53:46 +0100 [thread overview]
Message-ID: <20230320145449.985762283@linuxfoundation.org> (raw)
In-Reply-To: <20230320145449.336983711@linuxfoundation.org>
From: Breno Leitao <leitao@debian.org>
[ Upstream commit bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09 ]
tcp_rtx_synack() now could be called in process context as explained in
0a375c822497 ("tcp: tcp_rtx_synack() can be called from process
context").
tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU
variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90
Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use
TCP_INC_STATS() which is safe to be called from context switch.
Fixes: 8336886f786f ("tcp: TCP Fast Open Server - support TFO listeners")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230308190745.780221-1-leitao@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 33ba1268a111f..1f39b56bbab32 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3610,7 +3610,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
th->window = htons(min(req->rsk_rcv_wnd, 65535U));
tcp_options_write((__be32 *)(th + 1), NULL, &opts);
th->doff = (tcp_header_size >> 2);
- __TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
#ifdef CONFIG_TCP_MD5SIG
/* Okay, we have all we need - do the md5 hash if needed */
--
2.39.2
next prev parent reply other threads:[~2023-03-20 15:04 UTC|newest]
Thread overview: 126+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-20 14:53 [PATCH 5.15 000/115] 5.15.104-rc1 review Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 001/115] xfrm: Allow transport-mode states with AF_UNSPEC selector Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 002/115] drm/panfrost: Dont sync rpm suspension after mmu flushing Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 003/115] cifs: Move the in_send statistic to __smb_send_rqst() Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 004/115] drm/meson: fix 1px pink line on GXM when scaling video overlay Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 005/115] clk: HI655X: select REGMAP instead of depending on it Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 006/115] docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 007/115] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 008/115] ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 009/115] netfilter: nft_nat: correct length for loading protocol registers Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 010/115] netfilter: nft_masq: " Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 011/115] netfilter: nft_redir: " Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 012/115] netfilter: nft_redir: correct value of inet type `.maxattrs` Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 013/115] scsi: core: Fix a procfs host directory removal regression Greg Kroah-Hartman
2023-03-20 14:53 ` Greg Kroah-Hartman [this message]
2023-03-20 14:53 ` [PATCH 5.15 015/115] nfc: pn533: initialize struct pn533_out_arg properly Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 016/115] ipvlan: Make skb->skb_iif track skb->dev for l3s mode Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 017/115] i40e: Fix kernel crash during reboot when adapter is in recovery mode Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 018/115] vdpa_sim: not reset state in vdpasim_queue_ready Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 019/115] vdpa_sim: set last_used_idx as last_avail_idx " Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 020/115] PCI: s390: Fix use-after-free of PCI resources with per-function hotplug Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 021/115] drm/i915/display: Workaround cursor left overs with PSR2 selective fetch enabled Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 022/115] drm/i915/display/psr: Use drm damage helpers to calculate plane damaged area Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 023/115] drm/i915/display/psr: Handle plane and pipe restrictions at every page flip Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 024/115] drm/i915/display: clean up comments Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 025/115] drm/i915/psr: Use calculated io and fast wake lines Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 026/115] net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() Greg Kroah-Hartman
2023-03-20 14:53 ` [PATCH 5.15 027/115] qed/qed_dev: guard against a possible division by zero Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 028/115] net: dsa: mt7530: remove now incorrect comment regarding port 5 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 029/115] net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 030/115] loop: Fix use-after-free issues Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 031/115] net: tunnels: annotate lockless accesses to dev->needed_headroom Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 032/115] net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 033/115] nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 034/115] net/smc: fix deadlock triggered by cancel_delayed_work_syn() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 035/115] net: usb: smsc75xx: Limit packet length to skb->len Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 036/115] drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 037/115] block: null_blk: Fix handling of fake timeout request Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 038/115] nvme: fix handling single range discard request Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 039/115] nvmet: avoid potential UAF in nvmet_req_complete() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 040/115] block: sunvdc: add check for mdesc_grab() returning NULL Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 041/115] ice: xsk: disable txq irq before flushing hw Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 042/115] net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 043/115] ravb: avoid PHY being resumed when interface is not up Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 044/115] sh_eth: " Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 045/115] ipv4: Fix incorrect table ID in IOCTL path Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 046/115] net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 047/115] net/iucv: Fix size of interrupt data Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 048/115] selftests: net: devlink_port_split.py: skip test if no suitable device available Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 049/115] qed/qed_mng_tlv: correctly zero out ->min instead of ->hour Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 050/115] ethernet: sun: add check for the mdesc_grab() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 051/115] bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 052/115] bonding: restore bonds IFF_SLAVE flag if a non-eth dev enslave fails Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 053/115] hwmon: (adt7475) Display smoothing attributes in correct order Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 054/115] hwmon: (adt7475) Fix masking of hysteresis registers Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 055/115] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 056/115] hwmon: (ina3221) return prober error code Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 057/115] hwmon: (ucd90320) Add minimum delay between bus accesses Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 058/115] hwmon: tmp512: drop of_match_ptr for ID table Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 059/115] kconfig: Update config changed flag before calling callback Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 060/115] hwmon: (adm1266) Set `can_sleep` flag for GPIO chip Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 061/115] hwmon: (ltc2992) " Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 062/115] media: m5mols: fix off-by-one loop termination error Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 063/115] mmc: atmel-mci: fix race between stop command and start of next command Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 064/115] jffs2: correct logic when creating a hole in jffs2_write_begin Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 065/115] rust: arch/um: Disable FP/SIMD instruction to match x86 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 066/115] ext4: fail ext4_iget if special inode unallocated Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 067/115] ext4: update s_journal_inum if it changes after journal replay Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 068/115] ext4: fix task hung in ext4_xattr_delete_inode Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 069/115] drm/amdkfd: Fix an illegal memory access Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 070/115] net/9p: fix bug in client create for .L Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 071/115] sh: intc: Avoid spurious sizeof-pointer-div warning Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 072/115] drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 073/115] ext4: fix possible double unlock when moving a directory Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 074/115] tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 075/115] serial: 8250_em: Fix UART port type Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 076/115] serial: 8250_fsl: fix handle_irq locking Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 077/115] firmware: xilinx: dont make a sleepable memory allocation from an atomic context Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 078/115] s390/ipl: add missing intersection check to ipl_report handling Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 079/115] interconnect: fix mem leak when freeing nodes Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 080/115] interconnect: exynos: fix node leak in probe PM QoS error path Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 081/115] tracing: Make splice_read available again Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 082/115] tracing: Check field value in hist_field_name() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 083/115] tracing: Make tracepoint lockdep check actually test something Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 084/115] cifs: Fix smb2_set_path_size() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 085/115] KVM: nVMX: add missing consistency checks for CR0 and CR4 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 086/115] ALSA: hda: intel-dsp-config: add MTL PCI id Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.15 087/115] ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 088/115] Revert "riscv: mm: notify remote harts about mmu cache updates" Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 089/115] riscv: asid: Fixup stale TLB entry cause application crash Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 090/115] drm/shmem-helper: Remove another errant put in error path Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 091/115] drm/sun4i: fix missing component unbind on bind errors Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 092/115] drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 093/115] mptcp: fix possible deadlock in subflow_error_report Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 094/115] mptcp: add ro_after_init for tcp{,v6}_prot_override Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 095/115] mptcp: avoid setting TCP_CLOSE state twice Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 096/115] mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 097/115] ftrace: Fix invalid address access in lookup_rec() when index is 0 Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 098/115] nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 099/115] ice: avoid bonding causing auxiliary plug/unplug under RTNL lock Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 100/115] mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 101/115] mmc: sdhci_am654: lower power-on failed message severity Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 102/115] fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 103/115] trace/hwlat: Do not wipe the contents of per-cpu thread data Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 104/115] net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 105/115] cpuidle: psci: Iterate backwards over list in psci_pd_remove() Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 106/115] x86/mce: Make sure logged MCEs are processed after sysfs update Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 107/115] x86/mm: Fix use of uninitialized buffer in sme_enable() Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 108/115] x86/resctrl: Clear staged_config[] before and after it is used Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 109/115] drm/i915: Dont use stolen memory for ring buffers with LLC Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 110/115] drm/i915/active: Fix misuse of non-idle barriers as fence trackers Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 111/115] io_uring: avoid null-ptr-deref in io_arm_poll_handler Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 112/115] PCI: Unify delay handling for reset and resume Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 113/115] PCI/DPC: Await readiness of secondary bus after reset Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 114/115] HID: core: Provide new max_buffer_size attribute to over-ride the default Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.15 115/115] HID: uhid: Over-ride the default maximum data buffer value with our own Greg Kroah-Hartman
2023-03-20 17:18 ` [PATCH 5.15 000/115] 5.15.104-rc1 review Chris Paterson
2023-03-20 20:00 ` Florian Fainelli
2023-03-20 20:26 ` Naresh Kamboju
2023-03-20 23:05 ` Shuah Khan
2023-03-21 2:21 ` Allen Pais
2023-03-21 4:12 ` Harshit Mogalapalli
2023-03-21 4:47 ` Bagas Sanjaya
2023-03-21 11:56 ` Jon Hunter
2023-03-21 22:39 ` Ron Economos
2023-03-21 23:14 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230320145449.985762283@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=leitao@debian.org \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).