From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Breno Leitao <leitao@debian.org>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 17/60] tcp: tcp_make_synack() can be called from process context
Date: Mon, 20 Mar 2023 15:54:26 +0100 [thread overview]
Message-ID: <20230320145431.599599464@linuxfoundation.org> (raw)
In-Reply-To: <20230320145430.861072439@linuxfoundation.org>
From: Breno Leitao <leitao@debian.org>
[ Upstream commit bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09 ]
tcp_rtx_synack() now could be called in process context as explained in
0a375c822497 ("tcp: tcp_rtx_synack() can be called from process
context").
tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU
variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90
Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use
TCP_INC_STATS() which is safe to be called from context switch.
Fixes: 8336886f786f ("tcp: TCP Fast Open Server - support TFO listeners")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230308190745.780221-1-leitao@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b4a9f6948cb52..6ac84b273ffbb 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3374,7 +3374,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
th->window = htons(min(req->rsk_rcv_wnd, 65535U));
tcp_options_write((__be32 *)(th + 1), NULL, &opts);
th->doff = (tcp_header_size >> 2);
- __TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+ TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
#ifdef CONFIG_TCP_MD5SIG
/* Okay, we have all we need - do the md5 hash if needed */
--
2.39.2
next prev parent reply other threads:[~2023-03-20 15:06 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-20 14:54 [PATCH 5.4 00/60] 5.4.238-rc1 review Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 01/60] ext4: fix cgroup writeback accounting with fs-layer encryption Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 02/60] xfrm: Allow transport-mode states with AF_UNSPEC selector Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 03/60] drm/panfrost: Dont sync rpm suspension after mmu flushing Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 04/60] cifs: Move the in_send statistic to __smb_send_rqst() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 05/60] drm/meson: fix 1px pink line on GXM when scaling video overlay Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 06/60] clk: HI655X: select REGMAP instead of depending on it Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 07/60] docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 08/60] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 09/60] ALSA: hda - add Intel DG1 PCI and HDMI ids Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 10/60] ALSA: hda - controller is in GPU on the DG1 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 11/60] ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 12/60] ALSA: hda: Add Intel DG2 " Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 13/60] ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 14/60] netfilter: nft_redir: correct value of inet type `.maxattrs` Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 15/60] scsi: core: Fix a comment in function scsi_host_dev_release() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 16/60] scsi: core: Fix a procfs host directory removal regression Greg Kroah-Hartman
2023-03-20 14:54 ` Greg Kroah-Hartman [this message]
2023-03-20 14:54 ` [PATCH 5.4 18/60] nfc: pn533: initialize struct pn533_out_arg properly Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 19/60] ipvlan: Make skb->skb_iif track skb->dev for l3s mode Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 20/60] i40e: Fix kernel crash during reboot when adapter is in recovery mode Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 21/60] qed/qed_dev: guard against a possible division by zero Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 22/60] net: tunnels: annotate lockless accesses to dev->needed_headroom Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 23/60] net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 24/60] nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 25/60] net: usb: smsc75xx: Limit packet length to skb->len Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 26/60] nvmet: avoid potential UAF in nvmet_req_complete() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 27/60] block: sunvdc: add check for mdesc_grab() returning NULL Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 28/60] ipv4: Fix incorrect table ID in IOCTL path Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 29/60] net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 30/60] net/iucv: Fix size of interrupt data Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 31/60] ethernet: sun: add check for the mdesc_grab() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 32/60] hwmon: (adt7475) Display smoothing attributes in correct order Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 33/60] hwmon: (adt7475) Fix masking of hysteresis registers Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 34/60] hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 35/60] hwmon: (ina3221) return prober error code Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 36/60] media: m5mols: fix off-by-one loop termination error Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 37/60] mmc: atmel-mci: fix race between stop command and start of next command Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 38/60] jffs2: correct logic when creating a hole in jffs2_write_begin Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 39/60] rust: arch/um: Disable FP/SIMD instruction to match x86 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 40/60] ext4: fail ext4_iget if special inode unallocated Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 41/60] ext4: fix task hung in ext4_xattr_delete_inode Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 42/60] drm/amdkfd: Fix an illegal memory access Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 43/60] sh: intc: Avoid spurious sizeof-pointer-div warning Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 44/60] ext4: fix possible double unlock when moving a directory Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 45/60] tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 46/60] interconnect: fix mem leak when freeing nodes Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 47/60] tracing: Check field value in hist_field_name() Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 48/60] tracing: Make tracepoint lockdep check actually test something Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 49/60] KVM: nVMX: add missing consistency checks for CR0 and CR4 Greg Kroah-Hartman
2023-03-20 14:54 ` [PATCH 5.4 50/60] ftrace: Fix invalid address access in lookup_rec() when index is 0 Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 51/60] fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 52/60] x86/mm: Fix use of uninitialized buffer in sme_enable() Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 53/60] Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()" Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 54/60] treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() Greg Kroah-Hartman
2023-03-20 17:40 ` Tom Saeger
2023-03-20 14:55 ` [PATCH 5.4 55/60] drm/i915: Dont use stolen memory for ring buffers with LLC Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 56/60] serial: 8250_em: Fix UART port type Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 57/60] s390/ipl: add missing intersection check to ipl_report handling Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 58/60] PCI: Unify delay handling for reset and resume Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 59/60] HID: core: Provide new max_buffer_size attribute to over-ride the default Greg Kroah-Hartman
2023-03-20 14:55 ` [PATCH 5.4 60/60] HID: uhid: Over-ride the default maximum data buffer value with our own Greg Kroah-Hartman
2023-03-20 17:19 ` [PATCH 5.4 00/60] 5.4.238-rc1 review Chris Paterson
2023-03-20 18:46 ` Florian Fainelli
2023-03-20 20:36 ` Naresh Kamboju
2023-03-20 23:14 ` Shuah Khan
2023-03-20 23:37 ` Shuah Khan
2023-03-21 5:07 ` Harshit Mogalapalli
2023-03-21 11:54 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230320145431.599599464@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=leitao@debian.org \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).