netdev - [PATCH] libceph: queue_con only if the sock is connected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 2 Oct 2022 16:16:17 +0800
From:   Chen Yuanrun <chen-yuanrun@...mail.com>
To:     Ilya Dryomov <idryomov@...il.com>, Xiubo Li <xiubli@...hat.com>,
        Jeff Layton <jlayton@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     ceph-devel@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Chen Yuanrun <chen-yuanrun@...mail.com>
Subject: [PATCH] libceph: queue_con only if the sock is connected

tcp_sendmsg_locked will trigger sk->sk_write_space while the sock
is still connecting, if con try to write to a connecting sock,
sk->sk_write_space will be called again, which lead to a endless loop.

This will happen if the public network of the cluster is down, and
the cpu will be in high usage.

Signed-off-by: Chen Yuanrun <chen-yuanrun@...mail.com>
---
  net/ceph/messenger.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index d3bb656308b4..eef5d4dfd1f1 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -367,7 +367,8 @@ static void ceph_sock_write_space(struct sock *sk)
       * buffer. See net/ipv4/tcp_input.c:tcp_check_space()
       * and net/core/stream.c:sk_stream_write_space().
       */
-    if (ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING)) {
+    if (ceph_con_flag_test(con, CEPH_CON_F_WRITE_PENDING) &&
+        atomic_read(&con->sock_state) == CON_SOCK_STATE_CONNECTED) {
          if (sk_stream_is_writeable(sk)) {
              dout("%s %p queueing write work\n", __func__, con);
              clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);

-- 
2.31.1