Skip to contentSkip to conversation

Patch "net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Jun 29, 2017

Subsystems (2)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Jun 29 19:38:17 CEST 2017

From: Jia-Ju Bai <[email protected]>
Date: Sat, 10 Jun 2017 16:49:39 +0800
Subject: net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx

From: Jia-Ju Bai <[email protected]>

[ Upstream commit f146e872eb12ebbe92d8e583b2637e0741440db3 ]

The kernel may sleep under a rcu read lock in cfpkt_create_pfx, and the function call path is:
cfcnfg_linkup_rsp (acquire the lock by rcu_read_lock)
cfctrl_linkdown_req

    cfpkt_create
      cfpkt_create_pfx
        alloc_skb(GFP_KERNEL) --> may sleep
cfserl_receive (acquire the lock by rcu_read_lock)
  cfpkt_split
    cfpkt_create_pfx
      alloc_skb(GFP_KERNEL) --> may sleep

There is "in_interrupt" in cfpkt_create_pfx to decide use "GFP_KERNEL" or "GFP_ATOMIC". In this situation, "GFP_KERNEL" is used because the function is called under a rcu read lock, instead in interrupt.

To fix it, only "GFP_ATOMIC" is used in cfpkt_create_pfx.

---
 net/caif/cfpkt_skbuff.c |    6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)
net/caif/cfpkt_skbuff.c +1 -5
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u1
 {
 	struct sk_buff *skb;
 
-	if (likely(in_interrupt()))
-		skb = alloc_skb(len + pfx, GFP_ATOMIC);
-	else
-		skb = alloc_skb(len + pfx, GFP_KERNEL);
-
+	skb = alloc_skb(len + pfx, GFP_ATOMIC);
 	if (unlikely(skb == NULL))
 		return NULL;
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/net-caif-fix-a-sleep-in-atomic-bug-in-cfpkt_create_pfx.patch