From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sowmini Varadhan Subject: [PATCH net-next] rds: do not call ->conn_alloc with GFP_KERNEL Date: Mon, 12 Feb 2018 15:30:38 -0800 Message-ID: <1518478238-164533-1-git-send-email-sowmini.varadhan@oracle.com> Cc: sowmini.varadhan@oracle.com, santosh.shilimkar@oracle.com, rds-devel@oss.oracle.com Return-path: Received: from userp2130.oracle.com ([156.151.31.86]:39882 "EHLO userp2130.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932469AbeBLXtf (ORCPT ); Mon, 12 Feb 2018 18:49:35 -0500 To: davem@davemloft.net, netdev@vger.kernel.org To: sowmini.varadhan@oracle.com Sender: netdev-owner@vger.kernel.org List-ID: Commit ebeeb1ad9b8a ("rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management") adds an rcu read critical section to __rds_conn_create. The memory allocations in that critcal section need to use GFP_ATOMIC to avoid sleeping. This patch was verified with syzkaller reproducer. Reported-by: syzbot+a0564419941aaae3fe3c@syzkaller.appspotmail.com Signed-off-by: Sowmini Varadhan Fixes: ebeeb1ad9b8a ("rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management") --- net/rds/connection.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/net/rds/connection.c b/net/rds/connection.c index 94e190f..d0f5889 100644 --- a/net/rds/connection.c +++ b/net/rds/connection.c @@ -221,6 +221,8 @@ static void __rds_conn_path_init(struct rds_connection *conn, conn->c_path[i].cp_index = i; } rcu_read_lock(); + gfp &= ~GFP_KERNEL; + gfp |= GFP_ATOMIC; if (rds_destroy_pending(conn)) ret = -ENETDOWN; else -- 1.7.1