Martin KaFai Lau 9c7370a166 ipv6: Fix a potential deadlock when creating pcpu rt ... rt6_make_pcpu_route() is called under read_lock(&table->tb6_lock). rt6_make_pcpu_route() calls ip6_rt_pcpu_alloc(rt) which then calls dst_alloc(). dst_alloc() _may_ call ip6_dst_gc() which takes the write_lock(&tabl->tb6_lock). A visualized version: read_lock(&table->tb6_lock); rt6_make_pcpu_route(); => ip6_rt_pcpu_alloc(); => dst_alloc(); => ip6_dst_gc(); => write_lock(&table->tb6_lock); /* oops */ The fix is to do a read_unlock first before calling ip6_rt_pcpu_alloc(). A reported stack: [141625.537638] INFO: rcu_sched self-detected stall on CPU { 27} (t=60000 jiffies g=4159086 c=4159085 q=2139) [141625.547469] Task dump for CPU 27: [141625.550881] mtr R running task 0 22121 22081 0x00000008 [141625.558069] 0000000000000000 ffff88103f363d98 ffffffff8106e488 000000000000001b [141625.565641] ffffffff81684900 ffff88103f363db8 ffffffff810702b0 0000000008000000 [141625.573220] ffffffff81684900 ffff88103f363de8 ffffffff8108df9f ffff88103f375a00 [141625.580803] Call Trace: [141625.583345] <IRQ> [<ffffffff8106e488>] sched_show_task+0xc1/0xc6 [141625.589650] [<ffffffff810702b0>] dump_cpu_task+0x35/0x39 [141625.595144] [<ffffffff8108df9f>] rcu_dump_cpu_stacks+0x6a/0x8c [141625.601320] [<ffffffff81090606>] rcu_check_callbacks+0x1f6/0x5d4 [141625.607669] [<ffffffff810940c8>] update_process_times+0x2a/0x4f [141625.613925] [<ffffffff8109fbee>] tick_sched_handle+0x32/0x3e [141625.619923] [<ffffffff8109fc2f>] tick_sched_timer+0x35/0x5c [141625.625830] [<ffffffff81094a1f>] __hrtimer_run_queues+0x8f/0x18d [141625.632171] [<ffffffff81094c9e>] hrtimer_interrupt+0xa0/0x166 [141625.638258] [<ffffffff8102bf2a>] local_apic_timer_interrupt+0x4e/0x52 [141625.645036] [<ffffffff8102c36f>] smp_apic_timer_interrupt+0x39/0x4a [141625.651643] [<ffffffff8140b9e8>] apic_timer_interrupt+0x68/0x70 [141625.657895] <EOI> [<ffffffff81346ee8>] ? dst_destroy+0x7c/0xb5 [141625.664188] [<ffffffff813d45b5>] ? fib6_flush_trees+0x20/0x20 [141625.670272] [<ffffffff81082b45>] ? queue_write_lock_slowpath+0x60/0x6f [141625.677140] [<ffffffff8140aa33>] _raw_write_lock_bh+0x23/0x25 [141625.683218] [<ffffffff813d4553>] __fib6_clean_all+0x40/0x82 [141625.689124] [<ffffffff813d45b5>] ? fib6_flush_trees+0x20/0x20 [141625.695207] [<ffffffff813d6058>] fib6_clean_all+0xe/0x10 [141625.700854] [<ffffffff813d60d3>] fib6_run_gc+0x79/0xc8 [141625.706329] [<ffffffff813d0510>] ip6_dst_gc+0x85/0xf9 [141625.711718] [<ffffffff81346d68>] dst_alloc+0x55/0x159 [141625.717105] [<ffffffff813d09b5>] __ip6_dst_alloc.isra.32+0x19/0x63 [141625.723620] [<ffffffff813d1830>] ip6_pol_route+0x36a/0x3e8 [141625.729441] [<ffffffff813d18d6>] ip6_pol_route_output+0x11/0x13 [141625.735700] [<ffffffff813f02c8>] fib6_rule_action+0xa7/0x1bf [141625.741698] [<ffffffff813d18c5>] ? ip6_pol_route_input+0x17/0x17 [141625.748043] [<ffffffff81357c48>] fib_rules_lookup+0xb5/0x12a [141625.754050] [<ffffffff81141628>] ? poll_select_copy_remaining+0xf9/0xf9 [141625.761002] [<ffffffff813f0535>] fib6_rule_lookup+0x37/0x5c [141625.766914] [<ffffffff813d18c5>] ? ip6_pol_route_input+0x17/0x17 [141625.773260] [<ffffffff813d008c>] ip6_route_output+0x7a/0x82 [141625.779177] [<ffffffff813c44c8>] ip6_dst_lookup_tail+0x53/0x112 [141625.785437] [<ffffffff813c45c3>] ip6_dst_lookup_flow+0x2a/0x6b [141625.791604] [<ffffffff813ddaab>] rawv6_sendmsg+0x407/0x9b6 [141625.797423] [<ffffffff813d7914>] ? do_ipv6_setsockopt.isra.8+0xd87/0xde2 [141625.804464] [<ffffffff8139d4b4>] inet_sendmsg+0x57/0x8e [141625.810028] [<ffffffff81329ba3>] sock_sendmsg+0x2e/0x3c [141625.815588] [<ffffffff8132be57>] SyS_sendto+0xfe/0x143 [141625.821063] [<ffffffff813dd551>] ? rawv6_setsockopt+0x5e/0x67 [141625.827146] [<ffffffff8132c9f8>] ? sock_common_setsockopt+0xf/0x11 [141625.833660] [<ffffffff8132c08c>] ? SyS_setsockopt+0x81/0xa2 [141625.839565] [<ffffffff8140ac17>] entry_SYSCALL_64_fastpath+0x12/0x6a Fixes: d52d3997f8 ("pv6: Create percpu rt6_info") Signed-off-by: Martin KaFai Lau <kafai@fb.com> CC: Hannes Frederic Sowa <hannes@stressinduktion.org> Reported-by: Steinar H. Gunderson <sgunderson@bigfoot.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-08-17 14:28:03 -07:00
..
netfilter	netfilter: SYNPROXY: fix sending window update to client	2015-08-10 13:55:07 +02:00
Kconfig	ip6_vti: Fix build when NET_IP_TUNNEL is not set.	2014-02-20 14:29:49 +01:00
Makefile	net: Export IGMP/MLD message validation code	2015-05-04 14:49:23 -04:00
addrconf.c	ipv6: Consider RTF_CACHE when searching the fib6 tree	2015-05-01 20:57:06 -04:00
addrconf_core.c	ipv6: fix possible use after free of dev stats	2015-06-08 12:12:45 -07:00
addrlabel.c	netlink: implement nla_put_in_addr and nla_put_in6_addr	2015-03-31 13:58:35 -04:00
af_inet6.c	inet: add IP_BIND_ADDRESS_NO_PORT to overcome bind(0) limitations	2015-06-06 23:57:12 -07:00
ah6.c	ipv6: coding style: comparison for equality with NULL	2015-03-31 13:51:54 -04:00
anycast.c	ipv6: coding style: comparison for equality with NULL	2015-03-31 13:51:54 -04:00
datagram.c	ipv6: lock socket in ip6_datagram_connect()	2015-07-15 17:25:51 -07:00
esp6.c	esp6: Switch to new AEAD interface	2015-05-28 11:23:20 +08:00
exthdrs.c	net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited	2014-11-11 14:10:31 -05:00
exthdrs_core.c	ipv6: coding style: comparison for equality with NULL	2015-03-31 13:51:54 -04:00
exthdrs_offload.c	ipv6: Fix exthdrs offload registration.	2014-03-06 16:35:55 -05:00
fib6_rules.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-04-06 22:34:15 -04:00
icmp.c	ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST	2015-05-25 13:25:33 -04:00
inet6_connection_sock.c	net: convert syn_wait_lock to a spinlock	2015-03-23 16:52:26 -04:00
inet6_hashtables.c	tcp: connect() from bound sockets can be faster	2015-05-27 14:30:10 -04:00
ip6_checksum.c	udp: Generic functions to set checksum	2014-06-04 22:46:38 -07:00
ip6_fib.c	ipv6: Fix a potential deadlock when creating pcpu rt	2015-08-17 14:28:03 -07:00
ip6_flowlabel.c	ipv6: Flow label state ranges	2015-05-03 21:58:01 -04:00
ip6_gre.c	ip6_gre: use netdev_alloc_pcpu_stats()	2015-04-22 15:39:05 -04:00
ip6_icmp.c	ipv6: White-space cleansing : Line Layouts	2014-08-24 22:37:52 -07:00
ip6_input.c	ipv6: Make MLD packets to only be processed locally	2015-07-03 09:52:38 -07:00
ip6_offload.c	Revert "sit: Add gro callbacks to sit_offload"	2015-07-20 16:52:28 -07:00
ip6_offload.h	ipv6: Pull IPv6 GSO registration out of the module	2012-11-15 17:39:24 -05:00
ip6_output.c	ipv6: don't increase size when refragmenting forwarded ipv6 skbs	2015-05-25 17:22:23 -04:00
ip6_tunnel.c	ipv6: Add rt6_get_cookie() function	2015-05-25 13:25:34 -04:00
ip6_udp_tunnel.c	net: Modify sk_alloc to not reference count the netns of kernel sockets.	2015-05-11 10:50:18 -04:00
ip6_vti.c	vti6: Add pmtu handling to vti6_xmit.	2015-06-01 16:03:43 -07:00
ip6mr.c	netfilter: Pass socket pointer down through okfn().	2015-04-07 15:25:55 -04:00
ipcomp6.c	ipv6: White-space cleansing : Structure layouts	2014-08-24 22:37:52 -07:00
ipv6_sockglue.c	ipv6: coding style: comparison for equality with NULL	2015-03-31 13:51:54 -04:00
mcast.c	netfilter: Pass socket pointer down through okfn().	2015-04-07 15:25:55 -04:00
mcast_snoop.c	net: fix wrong skb_get() usage / crash in IGMP/MLD parsing code	2015-08-13 17:08:39 -07:00
mip6.c	net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited	2014-11-11 14:10:31 -05:00
ndisc.c	ipv6: flush nd cache on IFF_NOARP change	2015-07-29 23:01:39 -07:00
netfilter.c	netfilter: bridge: forward IPv6 fragmented packets	2015-06-12 14:10:12 +02:00
output_core.c	netfilter: don't pull include/linux/netfilter.h from netns headers	2015-06-18 21:14:31 +02:00
ping.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-03-09 23:38:02 -04:00
proc.c	udp: Increment UDP_MIB_IGNOREDMULTI for arriving unmatched multicasts	2014-11-07 15:45:50 -05:00
protocol.c	net: Export inet_offloads and inet6_offloads	2014-09-19 17:15:31 -04:00
raw.c	ipv6: drop unneeded goto	2015-05-30 23:48:36 -07:00
reassembly.c	inet: frags: remove INET_FRAG_EVICTED and use list_evictor for the test	2015-07-26 21:00:15 -07:00
route.c	ipv6: Fix a potential deadlock when creating pcpu rt	2015-08-17 14:28:03 -07:00
sit.c	ipv6: call iptunnel_xmit with NULL sock pointer if no tunnel sock is available	2015-04-08 12:09:43 -04:00
syncookies.c	tcp: get_cookie_sock() consolidation	2015-06-07 15:19:52 -07:00
sysctl_net_ipv6.c	ipv6: Flow label state ranges	2015-05-03 21:58:01 -04:00
tcp_ipv6.c	inet: fix possible request socket leak	2015-08-10 21:17:45 -07:00
tcpv6_offload.c	tcp: cleanup static functions	2015-02-28 16:56:51 -05:00
tunnel6.c	ipv6: White-space cleansing : gaps between function and symbol export	2014-08-24 22:37:52 -07:00
udp.c	udp: fix behavior of wrong checksums	2015-05-31 21:42:18 -07:00
udp_impl.h	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
udp_offload.c	ipv6: hash net ptr into fragmentation bucket selection	2015-03-25 14:07:04 -04:00
udplite.c	net: Eliminate no_check from protosw	2014-05-23 16:28:53 -04:00
xfrm6_input.c	netfilter: Pass socket pointer down through okfn().	2015-04-07 15:25:55 -04:00
xfrm6_mode_beet.c	xfrm: simplify xfrm_address_t use	2015-03-31 13:58:35 -04:00
xfrm6_mode_ro.c	ipv4/ipv6: Fix FSF address in file headers	2013-12-06 12:37:56 -05:00
xfrm6_mode_transport.c	[IPSEC]: Use IPv6 calling convention as the convention for x->mode->output	2007-10-10 16:55:54 -07:00
xfrm6_mode_tunnel.c	xfrm6: Remove xfrm_tunnel_notifier	2014-03-14 07:28:08 +01:00
xfrm6_output.c	netfilter: Pass socket pointer down through okfn().	2015-04-07 15:25:55 -04:00
xfrm6_policy.c	ipv6: Add rt6_get_cookie() function	2015-05-25 13:25:34 -04:00
xfrm6_protocol.c	xfrm6: Properly handle unsupported protocols	2014-05-06 07:08:38 +02:00
xfrm6_state.c	ipv6: White-space cleansing : Line Layouts	2014-08-24 22:37:52 -07:00
xfrm6_tunnel.c	ipv6: White-space cleansing : gaps between function and symbol export	2014-08-24 22:37:52 -07:00