netdev - Re: [PATCH] NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20090713.103139.188324296.davem@davemloft.net>
Date:	Mon, 13 Jul 2009 10:31:39 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	alan@...rguk.ukuu.org.uk
Cc:	ralf@...ux-mips.org, netdev@...r.kernel.org,
	guido@...ntalancia.com, paulus@...ba.org,
	linux-hams@...r.kernel.org, hans@...ac.ele.tue.nl
Subject: Re: [PATCH] NET: Fix locking issues in PPP, 6pack, mkiss and strip
 line disciplines.

From: Alan Cox <alan@...rguk.ukuu.org.uk>
Date: Mon, 13 Jul 2009 09:19:28 +0100

> Historically it went
> 
> 		network bh
> 			transmit packet
> 				ldisc layer
> 					tty write method
> 
> and lots of code assumed that.

They still can assume such things.  All locking is BH based, all
networking transmit paths occur in BH or with BH's disabled, never in
hardware interrupt context.

Even TX reclaim hardware interrupts that free SKBs reschedule that
work to BH context.

> Today the network bits get kicked off at IRQ level.

That would be news to me :)

Where do you see that in the traces that Ralf posted?  His trace was
in fact a TTY receive path via USB:

cpu_idle()
	handle_IRQ_event()
	uhci_irq()
	ftdi_read_bulk_callback()
	ftdi_process_read()
	tty_flip_buffer()
		flush_to_ldisc()
		mkiss_receive_buf()
		spin_lock_bh() --> BH disable in hard IRQ, OH NOEZ!

And, as Ralf's changelog stated:

--------------------
The issue was, that the locking code in mkiss was assuming it was only
ever being called in process or bh context.  Fixed by converting the
involved locking code to use irq-safe locks.
--------------------

mkiss_receive_buf(), the problematic code path, is invoked by
the TTY layer directly from LDISC flushing and the TTY device's
IRQ handler here.

How does networking's TX policy have anything to do with this?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html