From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.codeaurora.org by pdx-caf-mail.web.codeaurora.org (Dovecot) with LMTP id stl4O+byG1vpXwAAmS7hNA ; Sat, 09 Jun 2018 15:35:20 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 9E335608C9; Sat, 9 Jun 2018 15:35:20 +0000 (UTC) Authentication-Results: smtp.codeaurora.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="SiB3fZwQ" X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on pdx-caf-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,T_DKIMWL_WL_HIGH autolearn=ham autolearn_force=no version=3.4.0 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by smtp.codeaurora.org (Postfix) with ESMTP id EB6C3606FA; Sat, 9 Jun 2018 15:35:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org EB6C3606FA Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753774AbeFIPfR (ORCPT + 25 others); Sat, 9 Jun 2018 11:35:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:37516 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933011AbeFIPfN (ORCPT ); Sat, 9 Jun 2018 11:35:13 -0400 Received: from localhost (D57E6652.static.ziggozakelijk.nl [213.126.102.82]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A7F722087B; Sat, 9 Jun 2018 15:35:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1528558513; bh=FbkNr10BuLDNQAwrELH+m+BoTvPenbniKQEYH9mmTRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SiB3fZwQque9vKF6G3numnqNxDC1oGK5v9aC0FIBG5KkIaT7A6mfs3PAymzcy+4YF schDyhTATLlqQI5VcPvNxtkt5hddq5R1aRw1/ZvbAOUUPA9iy5rRZa0/u61ypOsUdV WL0edn0WlWKVotmNqH9qoD3ecOqSwkEPxdU1pmIU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+3dcd59a1f907245f891f@syzkaller.appspotmail.com, Marcelo Ricardo Leitner , Xin Long , Neil Horman , "David S. Miller" Subject: [PATCH 4.14 26/41] sctp: not allow transport timeout value less than HZ/5 for hb_timer Date: Sat, 9 Jun 2018 17:29:58 +0200 Message-Id: <20180609152927.841010824@linuxfoundation.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180609152926.389750182@linuxfoundation.org> References: <20180609152926.389750182@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xin Long [ Upstream commit 1d88ba1ebb2763aa86172cd7ca05dedbeccc0d35 ] syzbot reported a rcu_sched self-detected stall on CPU which is caused by too small value set on rto_min with SCTP_RTOINFO sockopt. With this value, hb_timer will get stuck there, as in its timer handler it starts this timer again with this value, then goes to the timer handler again. This problem is there since very beginning, and thanks to Eric for the reproducer shared from a syzbot mail. This patch fixes it by not allowing sctp_transport_timeout to return a smaller value than HZ/5 for hb_timer, which is based on TCP's min rto. Note that it doesn't fix this issue by limiting rto_min, as some users are still using small rto and no proper value was found for it yet. Reported-by: syzbot+3dcd59a1f907245f891f@syzkaller.appspotmail.com Suggested-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Acked-by: Neil Horman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sctp/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/sctp/transport.c +++ b/net/sctp/transport.c @@ -637,7 +637,7 @@ unsigned long sctp_transport_timeout(str trans->state != SCTP_PF) timeout += trans->hbinterval; - return timeout; + return max_t(unsigned long, timeout, HZ / 5); } /* Reset transport variables to their initial values */