From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"David S. Miller" <davem@davemloft.net>,
"Ani Sinha" <ani@arista.com>,
"Eric Dumazet" <edumazet@google.com>
Subject: [PATCH 3.2 50/52] ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.
Date: Tue, 24 Nov 2015 22:33:59 +0000 [thread overview]
Message-ID: <lsq.1448404439.650890439@decadent.org.uk> (raw)
In-Reply-To: <lsq.1448404438.351251660@decadent.org.uk>
3.2.74-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ani Sinha <ani@arista.com>
[ Upstream commit 44f49dd8b5a606870a1f21101522a0f9c4414784 ]
Fixes the following kernel BUG :
BUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758
caller is __this_cpu_preempt_check+0x13/0x15
CPU: 0 PID: 2758 Comm: bash Tainted: P O 3.18.19 #2
ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000
0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800
ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8
Call Trace:
[<ffffffff81482b2a>] dump_stack+0x52/0x80
[<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1
[<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15
[<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c
[<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e
[<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810e6974>] ? pollwake+0x4d/0x51
[<ffffffff81058ac0>] ? default_wake_function+0x0/0xf
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810613d9>] ? __wake_up_common+0x45/0x77
[<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32
[<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53
[<ffffffff8139a519>] ? sock_def_readable+0x71/0x75
[<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55
[<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41
[<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86
[<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d
[<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b
[<ffffffff810d5738>] ? new_sync_read+0x82/0xaa
[<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99
[<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32
[<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f
[<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf
[<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3
[<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e
Signed-off-by: Ani Sinha <ani@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: ipmr doesn't implement IPSTATS_MIB_OUTOCTETS]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1590,7 +1590,7 @@ static inline int ipmr_forward_finish(st
{
struct ip_options *opt = &(IPCB(skb)->opt);
- IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+ IP_INC_STATS(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
if (unlikely(opt->optlen))
ip_forward_options(skb);
@@ -1652,7 +1652,7 @@ static void ipmr_queue_xmit(struct net *
* to blackhole.
*/
- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
+ IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
ip_rt_put(rt);
goto out_free;
}
next prev parent reply other threads:[~2015-11-24 22:42 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-24 22:33 [PATCH 3.2 00/52] 3.2.74-rc1 review Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 48/52] irda: precedence bug in irlmp_seq_hb_idx() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 25/52] mtd: blkdevs: fix potential deadlock + lockdep warnings Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 20/52] ACPI: Use correct IRQ when uninstalling ACPI interrupt handler Ben Hutchings
2015-11-25 2:37 ` Chen, Yu C
2015-11-24 22:33 ` [PATCH 3.2 30/52] ALSA: hda - Apply pin fixup for HP ProBook 6550b Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 10/52] Btrfs: added helper btrfs_next_item() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 21/52] MIPS: atomic: Fix comment describing atomic64_add_unless's return value Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 33/52] x86/cpu: Call verify_cpu() after having entered long mode too Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 51/52] net: avoid NULL deref in inet_ctl_sock_destroy() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 34/52] Btrfs: fix race leading to incorrect item deletion when dropping extents Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 14/52] Btrfs: don't use ram_bytes for uncompressed inline items Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 15/52] Btrfs: fix truncation of compressed and inlined extents Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 06/52] mwifiex: fix mwifiex_rdeeprom_read() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 09/52] packet: fix match_fanout_group() Ben Hutchings
2015-11-24 22:33 ` Ben Hutchings [this message]
2015-11-24 22:33 ` [PATCH 3.2 37/52] scsi_sysfs: Fix queue_ramp_up_period return code Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 02/52] PCI: Use function 0 VPD for identical functions, regular VPD for others Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 31/52] firewire: ohci: fix JMicron JMB38x IT context discovery Ben Hutchings
2015-11-24 23:48 ` Stefan Richter
2015-11-24 22:33 ` [PATCH 3.2 01/52] PCI: Fix devfn for VPD access through function 0 Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 08/52] devres: fix a for loop bounds check Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 36/52] perf: Fix inherited events vs. tracepoint filters Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 07/52] mtd: mtdpart: fix add_mtd_partitions error path Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 49/52] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 19/52] staging: rtl8712: Add device ID for Sitecom WLA2100 Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 05/52] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 41/52] KVM: svm: unconditionally intercept #DB Ben Hutchings
2015-11-25 11:31 ` Paolo Bonzini
2015-11-25 17:56 ` Ben Hutchings
2015-11-25 18:06 ` Paolo Bonzini
2015-11-24 22:33 ` [PATCH 3.2 39/52] scsi: Fix a bdi reregistration race Ben Hutchings
2015-11-24 22:39 ` Bart Van Assche
2015-11-25 18:00 ` Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 03/52] mac80211: fix driver RSSI event calculations Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 22/52] ALSA: hda - Disable 64bit address for Creative HDA controllers Ben Hutchings
2015-11-25 23:05 ` Luis Henriques
2015-11-26 0:34 ` Ben Hutchings
2015-11-26 10:30 ` Luis Henriques
2015-11-24 22:33 ` [PATCH 3.2 38/52] Btrfs: fix race when listing an inode's xattrs Ben Hutchings
2015-11-25 23:11 ` Luis Henriques
2015-11-26 0:39 ` Ben Hutchings
2015-11-26 9:39 ` Filipe Manana
2015-11-24 22:33 ` [PATCH 3.2 16/52] ext4, jbd2: ensure entering into panic after recording an error in superblock Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 18/52] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 32/52] scsi: restart list search after unlock in scsi_remove_target Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 27/52] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 43/52] FS-Cache: Don't override netfs's primary_index if registering failed Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 23/52] megaraid_sas: Do not use PAGE_SIZE for max_sectors Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 26/52] crypto: algif_hash - Only export and import on sockets with data Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 04/52] HID: core: Avoid uninitialized buffer access Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 17/52] Bluetooth: ath3k: Add new AR3012 0930:021c id Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 13/52] ARM: pxa: remove incorrect __init annotation on pxa27x_set_pwrmode Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 24/52] can: Use correct type in sizeof() in nla_put() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 52/52] splice: sendfile() at once fails for big files Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 46/52] fs: make dumpable=2 require fully qualified path Ben Hutchings
2015-11-25 2:06 ` James Morris
2015-11-25 17:57 ` Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 12/52] iommu/vt-d: Fix ATSR handling for Root-Complex integrated endpoints Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 42/52] FS-Cache: Increase reference of parent after registering, netfs success Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 47/52] fs: if a coredump already exists, unlink and recreate with O_EXCL Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 44/52] FS-Cache: Handle a write to the page immediately beyond the EOF marker Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 29/52] ipv6: fix tunnel error handling Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 40/52] net: fix a race in dst_release() Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 45/52] binfmt_elf: Don't clobber passed executable's file header Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 28/52] recordmcount: Fix endianness handling bug for nop_mcount Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 11/52] Btrfs: fix file corruption and data loss after cloning inline extents Ben Hutchings
2015-11-24 22:33 ` [PATCH 3.2 35/52] Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow Ben Hutchings
2015-11-25 2:22 ` [PATCH 3.2 00/52] 3.2.74-rc1 review Guenter Roeck
2015-11-25 17:57 ` Ben Hutchings
2015-11-25 17:43 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1448404439.650890439@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=ani@arista.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®