| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250130211539.428952-7-almasrymina@google.com>
Date: Thu, 30 Jan 2025 21:15:39 +0000
From: Mina Almasry <almasrymina@...gle.com>
To: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-doc@...r.kernel.org, kvm@...r.kernel.org,
virtualization@...ts.linux.dev, linux-kselftest@...r.kernel.org
Cc: Mina Almasry <almasrymina@...gle.com>, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Simon Horman <horms@...nel.org>, Donald Hunter <donald.hunter@...il.com>,
Jonathan Corbet <corbet@....net>, Andrew Lunn <andrew+netdev@...n.ch>, David Ahern <dsahern@...nel.org>,
Stefan Hajnoczi <stefanha@...hat.com>, Stefano Garzarella <sgarzare@...hat.com>,
"Michael S. Tsirkin" <mst@...hat.com>, Jason Wang <jasowang@...hat.com>,
Xuan Zhuo <xuanzhuo@...ux.alibaba.com>,
"Eugenio Pérez" <eperezma@...hat.com>, Shuah Khan <shuah@...nel.org>, sdf@...ichev.me,
asml.silence@...il.com, dw@...idwei.uk, Jamal Hadi Salim <jhs@...atatu.com>,
Victor Nogueira <victor@...atatu.com>, Pedro Tammela <pctammela@...atatu.com>
Subject: [PATCH RFC net-next v2 6/6] net: devmem: make dmabuf unbinding
scheduled work
The TX path may release the dmabuf in a context where we cannot wait.
This happens when the user unbinds a TX dmabuf while there are still
references to its netmems in the TX path. In that case, the netmems will
be put_netmem'd from a context where we can't unmap the dmabuf,
resulting in a BUG like seen by Stan:
[ 1.548495] BUG: sleeping function called from invalid context at drivers/dma-buf/dma-buf.c:1255
[ 1.548741] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 149, name: ncdevmem
[ 1.548926] preempt_count: 201, expected: 0
[ 1.549026] RCU nest depth: 0, expected: 0
[ 1.549197]
[ 1.549237] =============================
[ 1.549331] [ BUG: Invalid wait context ]
[ 1.549425] 6.13.0-rc3-00770-gbc9ef9606dc9-dirty #15 Tainted: G W
[ 1.549609] -----------------------------
[ 1.549704] ncdevmem/149 is trying to lock:
[ 1.549801] ffff8880066701c0 (reservation_ww_class_mutex){+.+.}-{4:4}, at: dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.550051] other info that might help us debug this:
[ 1.550167] context-{5:5}
[ 1.550229] 3 locks held by ncdevmem/149:
[ 1.550322] #0: ffff888005730208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x40/0xf0
[ 1.550530] #1: ffff88800b148f98 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_close+0x19/0x80
[ 1.550731] #2: ffff88800b148f18 (slock-AF_INET6){+.-.}-{3:3}, at: __tcp_close+0x185/0x4b0
[ 1.550921] stack backtrace:
[ 1.550990] CPU: 0 UID: 0 PID: 149 Comm: ncdevmem Tainted: G W 6.13.0-rc3-00770-gbc9ef9606dc9-dirty #15
[ 1.551233] Tainted: [W]=WARN
[ 1.551304] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
[ 1.551518] Call Trace:
[ 1.551584] <TASK>
[ 1.551636] dump_stack_lvl+0x86/0xc0
[ 1.551723] __lock_acquire+0xb0f/0xc30
[ 1.551814] ? dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.551941] lock_acquire+0xf1/0x2a0
[ 1.552026] ? dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.552152] ? dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.552281] ? dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.552408] __ww_mutex_lock+0x121/0x1060
[ 1.552503] ? dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.552648] ww_mutex_lock+0x3d/0xa0
[ 1.552733] dma_buf_unmap_attachment_unlocked+0x4b/0x90
[ 1.552857] __net_devmem_dmabuf_binding_free+0x56/0xb0
[ 1.552979] skb_release_data+0x120/0x1f0
[ 1.553074] __kfree_skb+0x29/0xa0
[ 1.553156] tcp_write_queue_purge+0x41/0x310
[ 1.553259] tcp_v4_destroy_sock+0x127/0x320
[ 1.553363] ? __tcp_close+0x169/0x4b0
[ 1.553452] inet_csk_destroy_sock+0x53/0x130
[ 1.553560] __tcp_close+0x421/0x4b0
[ 1.553646] tcp_close+0x24/0x80
[ 1.553724] inet_release+0x5d/0x90
[ 1.553806] sock_close+0x4a/0xf0
[ 1.553886] __fput+0x9c/0x2b0
[ 1.553960] task_work_run+0x89/0xc0
[ 1.554046] do_exit+0x27f/0x980
[ 1.554125] do_group_exit+0xa4/0xb0
[ 1.554211] __x64_sys_exit_group+0x17/0x20
[ 1.554309] x64_sys_call+0x21a0/0x21a0
[ 1.554400] do_syscall_64+0xec/0x1d0
[ 1.554487] ? exc_page_fault+0x8a/0xf0
[ 1.554585] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1.554703] RIP: 0033:0x7f2f8a27abcd
Resolve this by making __net_devmem_dmabuf_binding_free schedule_work'd.
Suggested-by: Stanislav Fomichev <sdf@...ichev.me>
Signed-off-by: Mina Almasry <almasrymina@...gle.com>
---
net/core/devmem.c | 4 +++-
net/core/devmem.h | 10 ++++++----
2 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/core/devmem.c b/net/core/devmem.c
index 796338b1599e..58fcae0c0c69 100644
--- a/net/core/devmem.c
+++ b/net/core/devmem.c
@@ -46,8 +46,10 @@ static dma_addr_t net_devmem_get_dma_addr(const struct net_iov *niov)
((dma_addr_t)net_iov_idx(niov) << PAGE_SHIFT);
}
-void __net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding)
+void __net_devmem_dmabuf_binding_free(struct work_struct *wq)
{
+ struct net_devmem_dmabuf_binding *binding = container_of(wq, typeof(*binding), unbind_w);
+
size_t size, avail;
gen_pool_for_each_chunk(binding->chunk_pool,
diff --git a/net/core/devmem.h b/net/core/devmem.h
index 874e891e70e0..63d16dbaca2d 100644
--- a/net/core/devmem.h
+++ b/net/core/devmem.h
@@ -52,6 +52,8 @@ struct net_devmem_dmabuf_binding {
* net_iovs in the TX path.
*/
struct net_iov **tx_vec;
+
+ struct work_struct unbind_w;
};
#if defined(CONFIG_NET_DEVMEM)
@@ -74,7 +76,7 @@ struct dmabuf_genpool_chunk_owner {
struct net_devmem_dmabuf_binding *binding;
};
-void __net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding);
+void __net_devmem_dmabuf_binding_free(struct work_struct *wq);
struct net_devmem_dmabuf_binding *
net_devmem_bind_dmabuf(struct net_device *dev,
enum dma_data_direction direction,
@@ -129,7 +131,8 @@ net_devmem_dmabuf_binding_put(struct net_devmem_dmabuf_binding *binding)
if (!refcount_dec_and_test(&binding->ref))
return;
- __net_devmem_dmabuf_binding_free(binding);
+ INIT_WORK(&binding->unbind_w, __net_devmem_dmabuf_binding_free);
+ schedule_work(&binding->unbind_w);
}
void net_devmem_get_net_iov(struct net_iov *niov);
@@ -161,8 +164,7 @@ static inline void net_devmem_put_net_iov(struct net_iov *niov)
{
}
-static inline void
-__net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding)
+static inline void __net_devmem_dmabuf_binding_free(struct work_struct *wq)
{
}
--
2.48.1.362.g079036d154-goog
Powered by blists - more mailing lists