linux-kernel - [PATCH v3 8/7] pppoatm: fix missing wakeup in pppoatm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 07 Nov 2012 12:52:14 +0000
From:	David Woodhouse <dwmw2@...radead.org>
To:	Krzysztof Mazur <krzysiek@...lesie.net>
Cc:	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	Chas Williams - CONTRACTOR <chas@....nrl.navy.mil>,
	davem@...emloft.net
Subject: [PATCH v3 8/7] pppoatm: fix missing wakeup in pppoatm_send()

Now that we can return zero from pppoatm_send() for reasons *other* than
the queue being full, that means we can't depend on a subsequent call to
pppoatm_pop() waking the queue, and we might leave it stalled
indefinitely.

Fix this by immediately scheduling the wakeup tasklet. As documented
already elsewhere, the PPP channel's ->downl lock protects against the
wakeup happening too soon and effectively being missed.

Signed-off-by: David Woodhouse <David.Woodhouse@...el.com>
----
Untested.
With this sorted, Acked-By: David Woodhouse <David.Woodhouse@...el.com<
to the other seven. Thanks.

diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 7507c20..56ad541 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -283,11 +283,11 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 	vcc = ATM_SKB(skb)->vcc;
 	bh_lock_sock(sk_atm(vcc));
 	if (sock_owned_by_user(sk_atm(vcc)))
-		goto nospace;
+		goto nospace_sched_wakeup;
 	if (test_bit(ATM_VF_RELEASED, &vcc->flags)
-			|| test_bit(ATM_VF_CLOSE, &vcc->flags)
-			|| !test_bit(ATM_VF_READY, &vcc->flags))
-		goto nospace;
+	    || test_bit(ATM_VF_CLOSE, &vcc->flags)
+	    || !test_bit(ATM_VF_READY, &vcc->flags))
+		goto nospace_sched_wakeup;
 
 	switch (pvcc->encaps) {		/* LLC encapsulation needed */
 	case e_llc:
@@ -328,7 +328,17 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 	    ? DROP_PACKET : 1;
 	bh_unlock_sock(sk_atm(vcc));
 	return ret;
-nospace:
+ nospace_sched_wakeup:
+	/* If we're returning zero for reasons *other* than the queue
+	 * being full, then we need to ensure that a wakeup will
+	 * happen and not just leave the channel stalled for ever.
+	 * Just schedule the wakeup tasklet directly. As observed in
+	 * pppoatm_pop(), it'll take the channel's ->downl lock which
+	 * is also held by our caller, so it can't happen "too soon"
+	 * and cause us to effectively miss a wakeup.
+	 */
+	tasklet_schedule(&pvcc->wakeup_tasklet);
+ nospace:
 	bh_unlock_sock(sk_atm(vcc));
 	/*
 	 * We don't have space to send this SKB now, but we might have

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@...el.com                              Intel Corporation




Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (6171 bytes)