releases/4.9.70/tcp-dccp-block-bh-before-arming-time_wait-timer.patch

   1 From foo@baz Thu Dec 14 11:45:58 CET 2017
   2 From: Eric Dumazet <edumazet@google.com>
   3 Date: Fri, 1 Dec 2017 10:06:56 -0800
   4 Subject: tcp/dccp: block bh before arming time_wait timer
   5
   6 From: Eric Dumazet <edumazet@google.com>
   7
   8
   9 [ Upstream commit cfac7f836a715b91f08c851df915d401a4d52783 ]
  10
  11 Maciej Żenczykowski reported some panics in tcp_twsk_destructor()
  12 that might be caused by the following bug.
  13
  14 timewait timer is pinned to the cpu, because we want to transition
  15 timwewait refcount from 0 to 4 in one go, once everything has been
  16 initialized.
  17
  18 At the time commit ed2e92394589 ("tcp/dccp: fix timewait races in timer
  19 handling") was merged, TCP was always running from BH habdler.
  20
  21 After commit 5413d1babe8f ("net: do not block BH while processing
  22 socket backlog") we definitely can run tcp_time_wait() from process
  23 context.
  24
  25 We need to block BH in the critical section so that the pinned timer
  26 has still its purpose.
  27
  28 This bug is more likely to happen under stress and when very small RTO
  29 are used in datacenter flows.
  30
  31 Fixes: 5413d1babe8f ("net: do not block BH while processing socket backlog")
  32 Signed-off-by: Eric Dumazet <edumazet@google.com>
  33 Reported-by: Maciej Żenczykowski <maze@google.com>
  34 Acked-by: Maciej Żenczykowski <maze@google.com>
  35 Signed-off-by: David S. Miller <davem@davemloft.net>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37 ---
  38  net/dccp/minisocks.c     |    6 ++++++
  39  net/ipv4/tcp_minisocks.c |    6 ++++++
  40  2 files changed, 12 insertions(+)
  41
  42 --- a/net/dccp/minisocks.c
  43 +++ b/net/dccp/minisocks.c
  44 @@ -57,10 +57,16 @@ void dccp_time_wait(struct sock *sk, int
  45                 if (state == DCCP_TIME_WAIT)
  46                         timeo = DCCP_TIMEWAIT_LEN;
  47
  48 +               /* tw_timer is pinned, so we need to make sure BH are disabled
  49 +                * in following section, otherwise timer handler could run before
  50 +                * we complete the initialization.
  51 +                */
  52 +               local_bh_disable();
  53                 inet_twsk_schedule(tw, timeo);
  54                 /* Linkage updates. */
  55                 __inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
  56                 inet_twsk_put(tw);
  57 +               local_bh_enable();
  58         } else {
  59                 /* Sorry, if we're out of memory, just CLOSE this
  60                  * socket up.  We've got bigger problems than
  61 --- a/net/ipv4/tcp_minisocks.c
  62 +++ b/net/ipv4/tcp_minisocks.c
  63 @@ -328,10 +328,16 @@ void tcp_time_wait(struct sock *sk, int
  64                                 timeo = TCP_TIMEWAIT_LEN;
  65                 }
  66
  67 +               /* tw_timer is pinned, so we need to make sure BH are disabled
  68 +                * in following section, otherwise timer handler could run before
  69 +                * we complete the initialization.
  70 +                */
  71 +               local_bh_disable();
  72                 inet_twsk_schedule(tw, timeo);
  73                 /* Linkage updates. */
  74                 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
  75                 inet_twsk_put(tw);
  76 +               local_bh_enable();
  77         } else {
  78                 /* Sorry, if we're out of memory, just CLOSE this
  79                  * socket up.  We've got bigger problems than