Skip to contentSkip to conversation

FAILED: patch "[PATCH] inet: fix potential deadlock in reqsk_queue_unlink()" failed to apply to 5.10-stable tree

PATCH [email protected] 1 participant 1 message Nov 3

Subsystems (3)
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026110323-eleven-playlist-9820@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af Mon Sep 17 00:00:00 2001
From: Eric Dumazet <[email protected]>
Date: Thu, 13 Aug 2015 15:44:51 -0700
Subject: [PATCH] inet: fix potential deadlock in reqsk_queue_unlink()

When replacing del_timer() with del_timer_sync(), I introduced a deadlock condition :

reqsk_queue_unlink() is called from inet_csk_reqsk_queue_drop()

inet_csk_reqsk_queue_drop() can be called from many contexts, one being the timer handler itself (reqsk_timer_handler()).

In this case, del_timer_sync() loops forever.

Simple fix is to test if timer is pending.

Fixes 2235f2ac75fd ("inet: fix races with reqsk timers")
net/ipv4/inet_connection_sock.c +1 -1
index 05e3145f7dc3..134957159c27 100644
@@ -593,7 +593,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
 	}
 
 	spin_unlock(&queue->syn_wait_lock);
-	if (del_timer_sync(&req->rsk_timer))
+	if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
 		reqsk_put(req);
 	return found;
 }