netfilter: BUG: sleeping function called from invalid context

netfilter: BUG: sleeping function called from invalid context

[Heiko Carstens]

Hi,

Maran reported the bug below (vanilla 2.6.30-rc8):

BUG: sleeping function called from invalid context at /mnt/s390test/linux-2.6-tip/arch/s390/include/asm/uaccess.h:234 
in_atomic(): 1, irqs_disabled(): 0, pid: 3245, name: sysctl 
CPU: 1 Not tainted 2.6.30-rc8-tipjun10-02053-g39ae214 #1 
Process sysctl (pid: 3245, task: 000000007f675da0, ksp: 000000007eb17cf0) 
0000000000000000 000000007eb17be8 0000000000000002 0000000000000000  
       000000007eb17c88 000000007eb17c00 000000007eb17c00 0000000000048156  
       00000000003e2de8 000000007f676118 000000007eb17f10 0000000000000000  
       0000000000000000 000000007eb17be8 000000000000000d 000000007eb17c58  
       00000000003e2050 000000000001635c 000000007eb17be8 000000007eb17c30  
Call Trace: 
(Ý<00000000000162e6>¨ show_trace+0x13a/0x148) 
 Ý<00000000000349ea>¨ __might_sleep+0x13a/0x164 
 Ý<0000000000050300>¨ proc_dostring+0x134/0x22c 
 Ý<0000000000312b70>¨ nf_log_proc_dostring+0xfc/0x188 
 Ý<0000000000136f5e>¨ proc_sys_call_handler+0xf6/0x118 
 Ý<0000000000136fda>¨ proc_sys_read+0x26/0x34 
 Ý<00000000000d6e9c>¨ vfs_read+0xac/0x158 
 Ý<00000000000d703e>¨ SyS_read+0x56/0x88 
 Ý<0000000000027f42>¨ sysc_noemu+0x10/0x16 

The code that introduces the bug came in with 17625274 "netfilter:
sysctl support of logger choice".

There we have this chunk:

+               rcu_read_lock();
+               logger = rcu_dereference(nf_loggers[tindex]);
+               if (!logger)
+                       table->data = "NONE";
+               else
+                       table->data = logger->name;
+               r = proc_dostring(table, write, filp, buffer, lenp, ppos);
+               rcu_read_unlock();

proc_dostring() will call copy_from_user() while preemption is disabled
because of rcu_read_lock().
Looks like somebody needs to fix this ;)
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: netfilter: BUG: sleeping function called from invalid context

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 1982 bytes --]

Heiko Carstens wrote:
> Maran reported the bug below (vanilla 2.6.30-rc8):
> 
> BUG: sleeping function called from invalid context at /mnt/s390test/linux-2.6-tip/arch/s390/include/asm/uaccess.h:234 
> in_atomic(): 1, irqs_disabled(): 0, pid: 3245, name: sysctl 
> CPU: 1 Not tainted 2.6.30-rc8-tipjun10-02053-g39ae214 #1 
> Process sysctl (pid: 3245, task: 000000007f675da0, ksp: 000000007eb17cf0) 
> 0000000000000000 000000007eb17be8 0000000000000002 0000000000000000  
>        000000007eb17c88 000000007eb17c00 000000007eb17c00 0000000000048156  
>        00000000003e2de8 000000007f676118 000000007eb17f10 0000000000000000  
>        0000000000000000 000000007eb17be8 000000000000000d 000000007eb17c58  
>        00000000003e2050 000000000001635c 000000007eb17be8 000000007eb17c30  
> Call Trace: 
> (Ý<00000000000162e6>¨ show_trace+0x13a/0x148) 
>  Ý<00000000000349ea>¨ __might_sleep+0x13a/0x164 
>  Ý<0000000000050300>¨ proc_dostring+0x134/0x22c 
>  Ý<0000000000312b70>¨ nf_log_proc_dostring+0xfc/0x188 
>  Ý<0000000000136f5e>¨ proc_sys_call_handler+0xf6/0x118 
>  Ý<0000000000136fda>¨ proc_sys_read+0x26/0x34 
>  Ý<00000000000d6e9c>¨ vfs_read+0xac/0x158 
>  Ý<00000000000d703e>¨ SyS_read+0x56/0x88 
>  Ý<0000000000027f42>¨ sysc_noemu+0x10/0x16 
> 
> The code that introduces the bug came in with 17625274 "netfilter:
> sysctl support of logger choice".
> 
> There we have this chunk:
> 
> +               rcu_read_lock();
> +               logger = rcu_dereference(nf_loggers[tindex]);
> +               if (!logger)
> +                       table->data = "NONE";
> +               else
> +                       table->data = logger->name;
> +               r = proc_dostring(table, write, filp, buffer, lenp, ppos);
> +               rcu_read_unlock();
> 
> proc_dostring() will call copy_from_user() while preemption is disabled
> because of rcu_read_lock().
> Looks like somebody needs to fix this ;)

Thanks for the report. This patch should fix it.


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 692 bytes --]

diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index beb3731..2fefe14 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -248,14 +248,14 @@ static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
 		rcu_assign_pointer(nf_loggers[tindex], logger);
 		mutex_unlock(&nf_log_mutex);
 	} else {
-		rcu_read_lock();
-		logger = rcu_dereference(nf_loggers[tindex]);
+		mutex_lock(&nf_log_mutex);
+		logger = nf_loggers[tindex];
 		if (!logger)
 			table->data = "NONE";
 		else
 			table->data = logger->name;
 		r = proc_dostring(table, write, filp, buffer, lenp, ppos);
-		rcu_read_unlock();
+		mutex_unlock(&nf_log_mutex);
 	}
 
 	return r;

Re: netfilter: BUG: sleeping function called from invalid context

[Patrick McHardy]

Maran Pakkirisamy wrote:
> I have tested the patch against Vanilla Linux 2.6.30 RC8. The issue with 
> netfilter is fixed with the given patch . Thanks a lot!

Thanks, I'll send it upstream today.