Skip to contentSkip to conversation

rxrpc: Fix missing locking causing hanging calls

PATCH Applied David Howells 2 participants 3 messages Nov 6, 2024 – Nov 7, 2024

Subsystems (4)
Networking Network drivers Tracing Rxrpc sockets (AF_RXRPC)
lore
Share & tools
lore

David Howells

author maintainer
#0 lore raw

PATCH 1/1 rxrpc: Fix missing locking causing hanging calls

If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local->new_client_calls by rxrpc_disconnect_client_call() without a lock being held. This may cause other calls on the list to disappear if a race occurs.

Fix this by taking the client_call_lock when removing a call from whatever list its ->wait_link happens to be on.

Signed-off-by David Howells <[email protected]>
cc Marc Dionne <[email protected]>
cc "David S. Miller" <[email protected]>
cc Eric Dumazet <[email protected]>
cc Jakub Kicinski <[email protected]>
cc Paolo Abeni <[email protected]>
cc Simon Horman <[email protected]>
cc [email protected]
cc [email protected]
---
 include/trace/events/rxrpc.h |    1 +
 net/rxrpc/conn_client.c      |    4 ++++
 2 files changed, 5 insertions(+)
include/trace/events/rxrpc.h +1 -0
index c2f087e90fbe..d03e0bd8c028 100644
@@ -287,6 +287,7 @@
 	EM(rxrpc_call_see_input,		"SEE input   ") \
 	EM(rxrpc_call_see_release,		"SEE release ") \
 	EM(rxrpc_call_see_userid_exists,	"SEE u-exists") \
+	EM(rxrpc_call_see_waiting_call,		"SEE q-conn  ") \
 	E_(rxrpc_call_see_zap,			"SEE zap     ")
 
 #define rxrpc_txqueue_traces \
net/rxrpc/conn_client.c +4 -0
index d25bf1cf3670..bb11e8289d6d 100644
@@ -516,6 +516,7 @@ void rxrpc_connect_client_calls(struct rxrpc_local *local)
 
 		spin_lock(&local->client_call_lock);
 		list_move_tail(&call->wait_link, &bundle->waiting_calls);
+		rxrpc_see_call(call, rxrpc_call_see_waiting_call);
 		spin_unlock(&local->client_call_lock);
 
 		if (rxrpc_bundle_has_space(bundle))

@@ -586,7 +587,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_bundle *bundle, struct rxrpc_call
 		_debug("call is waiting");
 		ASSERTCMP(call->call_id, ==, 0);
 		ASSERT(!test_bit(RXRPC_CALL_EXPOSED, &call->flags));
+		/* May still be on ->new_client_calls. */
+		spin_lock(&local->client_call_lock);
 		list_del_init(&call->wait_link);
+		spin_unlock(&local->client_call_lock);
 		return;
 	}
CI Applied
#2 lore raw
In reply to David Howells
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Wed, 06 Nov 2024 13:03:22 +0000 you wrote:

If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local->new_client_calls by rxrpc_disconnect_client_call() without a lock being held. This may cause other calls on the list to disappear if a race occurs.

[...]

Here is the summary with links:
- [net] rxrpc: Fix missing locking causing hanging calls

    https://git.kernel.org/netdev/net/c/fc9de52de38f

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html