Eric Dumazet cbbb5a252d tcp: tcp_release_cb() should release socket ownership ... [ Upstream commit c3f9b01849 ] Lars Persson reported following deadlock : -000 |M:0x0:0x802B6AF8(asm) <-- arch_spin_lock -001 |tcp_v4_rcv(skb = 0x8BD527A0) <-- sk = 0x8BE6B2A0 -002 |ip_local_deliver_finish(skb = 0x8BD527A0) -003 |__netif_receive_skb_core(skb = 0x8BD527A0, ?) -004 |netif_receive_skb(skb = 0x8BD527A0) -005 |elk_poll(napi = 0x8C770500, budget = 64) -006 |net_rx_action(?) -007 |__do_softirq() -008 |do_softirq() -009 |local_bh_enable() -010 |tcp_rcv_established(sk = 0x8BE6B2A0, skb = 0x87D3A9E0, th = 0x814EBE14, ?) -011 |tcp_v4_do_rcv(sk = 0x8BE6B2A0, skb = 0x87D3A9E0) -012 |tcp_delack_timer_handler(sk = 0x8BE6B2A0) -013 |tcp_release_cb(sk = 0x8BE6B2A0) -014 |release_sock(sk = 0x8BE6B2A0) -015 |tcp_sendmsg(?, sk = 0x8BE6B2A0, ?, ?) -016 |sock_sendmsg(sock = 0x8518C4C0, msg = 0x87D8DAA8, size = 4096) -017 |kernel_sendmsg(?, ?, ?, ?, size = 4096) -018 |smb_send_kvec() -019 |smb_send_rqst(server = 0x87C4D400, rqst = 0x87D8DBA0) -020 |cifs_call_async() -021 |cifs_async_writev(wdata = 0x87FD6580) -022 |cifs_writepages(mapping = 0x852096E4, wbc = 0x87D8DC88) -023 |__writeback_single_inode(inode = 0x852095D0, wbc = 0x87D8DC88) -024 |writeback_sb_inodes(sb = 0x87D6D800, wb = 0x87E4A9C0, work = 0x87D8DD88) -025 |__writeback_inodes_wb(wb = 0x87E4A9C0, work = 0x87D8DD88) -026 |wb_writeback(wb = 0x87E4A9C0, work = 0x87D8DD88) -027 |wb_do_writeback(wb = 0x87E4A9C0, force_wait = 0) -028 |bdi_writeback_workfn(work = 0x87E4A9CC) -029 |process_one_work(worker = 0x8B045880, work = 0x87E4A9CC) -030 |worker_thread(__worker = 0x8B045880) -031 |kthread(_create = 0x87CADD90) -032 |ret_from_kernel_thread(asm) Bug occurs because __tcp_checksum_complete_user() enables BH, assuming it is running from softirq context. Lars trace involved a NIC without RX checksum support but other points are problematic as well, like the prequeue stuff. Problem is triggered by a timer, that found socket being owned by user. tcp_release_cb() should call tcp_write_timer_handler() or tcp_delack_timer_handler() in the appropriate context : BH disabled and socket lock held, but 'owned' field cleared, as if they were running from timer handlers. Fixes: 6f458dfb40 ("tcp: improve latencies of timer triggered events") Reported-by: Lars Persson <lars.persson@axis.com> Tested-by: Lars Persson <lars.persson@axis.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-04-14 06:42:16 -07:00
..
9p
bluetooth	Bluetooth: Introduce a new HCI_RFKILLED flag	2013-10-13 16:08:32 -07:00
caif	caif: Remove my bouncing email address.	2013-04-23 13:25:51 -04:00
irda	irda: small read past the end of array in debug code	2013-04-19 17:32:31 -04:00
iucv	af_iucv: fix recvmsg by replacing skb_pull() function	2013-04-08 17:16:57 -04:00
netfilter	netfilter: push reasm skb through instead of original frag skbs	2013-12-08 07:29:25 -08:00
netns	netfilter: nf_log: prepare net namespace support for loggers	2013-04-05 20:12:54 +02:00
nfc	NFC: RFKILL support	2013-04-12 16:54:45 +02:00
phonet
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-05-01 14:08:52 -07:00
tc_act
act_api.h
addrconf.h	IPv6 NAT: Do not drop DNATed 6to4/6rd packets	2013-10-13 16:08:30 -07:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	af_unix: fix a fatal race with bit fields	2013-05-01 15:13:49 -04:00
ah.h
arp.h
atmclip.h
ax25.h
ax88796.h
cfg80211-wext.h
cfg80211.h	cfg80211: introduce critical protocol indication from user-space	2013-04-22 15:48:00 +02:00
checksum.h
cipso_ipv4.h	net: fix cipso packet validation when !NETLABEL	2013-11-04 04:31:04 -08:00
cls_cgroup.h	cls_cgroup: remove task_struct parameter from sock_update_classid()	2013-04-09 13:19:35 -04:00
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
dn_dev.h
dn_fib.h	decnet: Parse netlink attributes on our own	2013-03-22 10:31:16 -04:00
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h
dsfield.h
dst_ops.h
dst.h	net: dst: provide accessor function to dst->xfrm	2013-11-04 04:31:03 -08:00
esp.h
ethoc.h
fib_rules.h
firewire.h	firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.	2013-03-26 12:32:13 -04:00
flow_keys.h	flow_keys: include thoff into flow_keys for later usage	2013-03-20 12:14:36 -04:00
flow.h
garp.h
gen_stats.h
genetlink.h	genl: Hold reference on correct module while netlink-dump.	2013-09-14 06:54:55 -07:00
gre.h	GRE: Refactor GRE tunneling code.	2013-03-26 12:27:18 -04:00
gro_cells.h
icmp.h
ieee80211_radiotap.h
ieee802154_netdev.h	ieee802154/nl-mac.c: make some MLME operations optional	2013-04-08 12:00:16 -04:00
ieee802154.h
if_inet6.h	net: ipv6: only invalidate previously tokenized addresses	2013-04-09 13:12:23 -04:00
inet_common.h
inet_connection_sock.h
inet_ecn.h
inet_frag.h	net: frag, fix race conditions in LRU list maintenance	2013-05-06 11:06:51 -04:00
inet_hashtables.h
inet_sock.h
inet_timewait_sock.h
inet6_connection_sock.h
inet6_hashtables.h
inetpeer.h
ip_fib.h
ip_tunnels.h	ip_gre: Fix WCCPv2 header parsing.	2013-11-20 12:27:46 -08:00
ip_vs.h	netfilter: push reasm skb through instead of original frag skbs	2013-12-08 07:29:25 -08:00
ip.h	inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions	2013-12-08 07:29:25 -08:00
ip6_checksum.h
ip6_fib.h	ipv6: reset dst.expires value when clearing expire flag	2013-11-20 12:27:46 -08:00
ip6_route.h	ipv6: fill rt6i_gateway with nexthop address	2013-11-04 04:31:05 -08:00
ip6_tunnel.h	GRE: Refactor GRE tunneling code.	2013-03-26 12:27:18 -04:00
ipcomp.h
ipconfig.h
ipv6.h	inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions	2013-12-08 07:29:25 -08:00
ipx.h
iw_handler.h
lapb.h
lib80211.h	hostap: Don't use create_proc_read_entry()	2013-04-29 15:41:56 -04:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
mac80211.h	mac80211: add a flag to indicate CCK support for HT clients	2013-09-07 22:09:59 -07:00
mac802154.h
mip6.h
mld.h
mrp.h
ndisc.h	ndisc: Add missing inline to ndisc_addr_option_pad	2013-08-11 18:35:26 -07:00
neighbour.h
net_namespace.h	netfilter: make /proc/net/netfilter pernet	2013-04-05 19:35:02 +02:00
net_ratelimit.h
netdma.h
netevent.h
netlabel.h
netlink.h
netprio_cgroup.h	netprio_cgroup: remove task_struct parameter from sock_update_netprio()	2013-04-09 13:19:37 -04:00
netrom.h
nexthop.h
nl802154.h
p8022.h
ping.h
pkt_cls.h
pkt_sched.h
protocol.h
psnap.h
raw.h
rawv6.h
red.h
regulatory.h
request_sock.h	net: remove a stale comment for dl_next	2013-04-22 15:55:48 -04:00
rose.h
route.h
rtnetlink.h	rtnetlink: Remove passing of attributes into rtnl_doit functions	2013-03-22 10:31:16 -04:00
sch_generic.h	net_sched: restore "linklayer atm" handling	2013-09-14 06:54:55 -07:00
scm.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-04-22 20:32:51 -04:00
secure_seq.h	net: net_secret should not depend on TCP	2013-10-13 16:08:30 -07:00
slhc_vj.h
snmp.h
sock.h	tcp: tcp_release_cb() should release socket ownership	2014-04-14 06:42:16 -07:00
stp.h
tcp_memcontrol.h
tcp_states.h
tcp.h	net-tcp: fastopen: fix high order allocations	2014-03-23 21:38:10 -07:00
timewait_sock.h
transp_v6.h
udp.h	ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data	2013-07-28 16:29:49 -07:00
udplite.h
wext.h
wimax.h
wpan-phy.h
x25.h
x25device.h
xfrm.h	xfrm: force a garbage collection after deleting a policy	2013-05-31 17:30:07 -07:00