Tejun Heo
20eb4f29b6
net: fix sk_page_frag() recursion from memory reclaim ...
sk_page_frag() optimizes skb_frag allocations by using per-task
skb_frag cache when it knows it's the only user. The condition is
determined by seeing whether the socket allocation mask allows
blocking - if the allocation may block, it obviously owns the task's
context and ergo exclusively owns current->task_frag.
Unfortunately, this misses recursion through memory reclaim path.
Please take a look at the following backtrace.
[2] RIP: 0010:tcp_sendmsg_locked+0xccf/0xe10
...
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
sock_xmit.isra.24+0xa1/0x170 [nbd]
nbd_send_cmd+0x1d2/0x690 [nbd]
nbd_queue_rq+0x1b5/0x3b0 [nbd]
__blk_mq_try_issue_directly+0x108/0x1b0
blk_mq_request_issue_directly+0xbd/0xe0
blk_mq_try_issue_list_directly+0x41/0xb0
blk_mq_sched_insert_requests+0xa2/0xe0
blk_mq_flush_plug_list+0x205/0x2a0
blk_flush_plug_list+0xc3/0xf0
[1] blk_finish_plug+0x21/0x2e
_xfs_buf_ioapply+0x313/0x460
__xfs_buf_submit+0x67/0x220
xfs_buf_read_map+0x113/0x1a0
xfs_trans_read_buf_map+0xbf/0x330
xfs_btree_read_buf_block.constprop.42+0x95/0xd0
xfs_btree_lookup_get_block+0x95/0x170
xfs_btree_lookup+0xcc/0x470
xfs_bmap_del_extent_real+0x254/0x9a0
__xfs_bunmapi+0x45c/0xab0
xfs_bunmapi+0x15/0x30
xfs_itruncate_extents_flags+0xca/0x250
xfs_free_eofblocks+0x181/0x1e0
xfs_fs_destroy_inode+0xa8/0x1b0
destroy_inode+0x38/0x70
dispose_list+0x35/0x50
prune_icache_sb+0x52/0x70
super_cache_scan+0x120/0x1a0
do_shrink_slab+0x120/0x290
shrink_slab+0x216/0x2b0
shrink_node+0x1b6/0x4a0
do_try_to_free_pages+0xc6/0x370
try_to_free_mem_cgroup_pages+0xe3/0x1e0
try_charge+0x29e/0x790
mem_cgroup_charge_skmem+0x6a/0x100
__sk_mem_raise_allocated+0x18e/0x390
__sk_mem_schedule+0x2a/0x40
[0] tcp_sendmsg_locked+0x8eb/0xe10
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
___sys_sendmsg+0x26d/0x2b0
__sys_sendmsg+0x57/0xa0
do_syscall_64+0x42/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
In [0], tcp_send_msg_locked() was using current->page_frag when it
called sk_wmem_schedule(). It already calculated how many bytes can
be fit into current->page_frag. Due to memory pressure,
sk_wmem_schedule() called into memory reclaim path which called into
xfs and then IO issue path. Because the filesystem in question is
backed by nbd, the control goes back into the tcp layer - back into
tcp_sendmsg_locked().
nbd sets sk_allocation to (GFP_NOIO | __GFP_MEMALLOC) which makes
sense - it's in the process of freeing memory and wants to be able to,
e.g., drop clean pages to make forward progress. However, this
confused sk_page_frag() called from [2]. Because it only tests
whether the allocation allows blocking which it does, it now thinks
current->page_frag can be used again although it already was being
used in [0].
After [2] used current->page_frag, the offset would be increased by
the used amount. When the control returns to [0],
current->page_frag's offset is increased and the previously calculated
number of bytes now may overrun the end of allocated memory leading to
silent memory corruptions.
Fix it by adding gfpflags_normal_context() which tests sleepable &&
!reclaim and use it to determine whether to use current->task_frag.
v2: Eric didn't like gfp flags being tested twice. Introduce a new
helper gfpflags_normal_context() and combine the two tests.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-28 16:17:31 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188
2019-05-30 11:29:21 -07:00
Bluetooth: Add support for utilizing Fast Advertising Interval
2019-09-05 17:27:21 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194
2019-05-30 11:29:22 -07:00
netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush
2019-09-25 11:01:19 +02:00
can: netns: remove "can_" prefix from members struct netns_can
2019-09-04 13:29:14 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
sctp: add chunks to sk_backlog when the newsk sk_socket is not set
2019-10-09 16:27:04 -07:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
net: sched: use get_dev() action API in flow_action infra
2019-09-16 09:18:03 +02:00
ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets
2019-08-19 17:19:46 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: split out functions related to registering inflight socket files
2019-02-28 08:24:23 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-05-05 11:25:49 -07:00
ax25: fix possible use-after-free
2019-01-23 11:18:00 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 90
2019-05-24 17:37:53 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 5
2019-05-21 11:28:40 +02:00
bonding: add an option to specify a delay between peer notifications
2019-07-04 12:30:48 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
bpf: support cloning sk storage on accept()
2019-08-17 23:18:54 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 335
2019-06-05 17:37:06 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
mac80211: fix scan when operating on DFS channels in ETSI domains
2019-10-07 22:10:50 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: rework SIOCGSTAMP ioctl handling
2019-04-19 14:07:40 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201
2019-05-30 11:29:52 -07:00
net: devlink: move reload fail indication to devlink core and expose to user
2019-09-13 22:11:14 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
2019-05-21 11:52:39 +02:00
drop_monitor: Add basic infrastructure for hardware drops
2019-08-17 12:40:08 -07:00
net: dsa: Pass ndo_setup_tc slave callback to drivers
2019-09-16 21:32:57 +02:00
net: dst.h: Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:48:34 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
net: fib: drop include of module.h from fib_notifier.h
2019-04-22 21:50:53 -07:00
net: fib_rules: do not flow dissect local packets
2019-07-11 14:22:53 -07:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net: sched: extend flow_action_entry with destructor
2019-09-16 09:18:02 +02:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
net/flow_dissector: switch to siphash
2019-10-23 20:13:22 -07:00
genetlink: optionally validate strictly/dumps
2019-04-27 17:07:22 -04:00
net: Move the definition of the default Geneve udp port to public header file
2019-03-22 12:09:31 -07:00
net:gue.h:Fix shifting signed 32-bit value by 31 bits problem
2019-07-01 10:58:23 -07:00
net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static
2019-10-25 16:24:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
wireless-drivers-next patches for 5.1
2019-02-22 12:56:24 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
ipv6: shrink struct ipv6_mc_socklist
2019-08-28 14:43:03 -07:00
net: ife: drop include of module.h from net/ife.h
2019-04-22 21:50:53 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
inet: factor out inet_send_prepare()
2019-07-03 13:51:54 -07:00
net/tls: use RCU protection on icsk->icsk_ulp_data
2019-08-31 23:44:28 -07:00
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
tcp: honor SO_PRIORITY in TIME_WAIT state
2019-09-27 12:05:02 +02:00
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-08 21:50:15 -08:00
ipv4: fix IPSKB_FRAG_PMTU handling with fragmentation
2019-10-21 10:46:42 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ipv6: Dump route exceptions if requested
2019-06-24 10:18:49 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-06-27 21:06:39 -07:00
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-06-18 20:48:45 -04:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
route: Add multipath_hash in flowi_common to make user-define hash
2019-02-27 12:50:17 -08:00
ipvs: move old_secure_tcp into struct netns_ipvs
2019-10-24 11:56:02 +02:00
ipv6: add priority parameter to ip6_xmit()
2019-09-27 12:05:02 +02:00
inet: fix various use-after-free in defrags units
2019-06-19 11:37:47 -04:00
ipv6: export function to send route updates
2019-05-22 17:48:43 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
llc: fix sk_buff leak in llc_conn_service()
2019-10-08 13:23:05 -07:00
lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap
2019-04-23 19:42:29 -07:00
mac80211: allow drivers to set max MTU
2019-09-11 09:33:29 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier
2019-07-22 12:10:54 -07:00
net ipv6: Prevent neighbor add if protocol is disabled on device
2019-04-17 23:19:07 -07:00
netns: fix GFP flags in rtnl_net_notifyid()
2019-10-25 20:14:42 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
2019-05-21 11:28:45 +02:00
netlink: Fix nlmsg_parse as a wrapper for strict message parsing
2019-08-13 20:37:16 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: netrom: Fix error cleanup path of nr_proto_init
2019-04-11 13:59:49 -07:00
net: Properly update v4 routes with v6 nexthop
2019-09-05 12:35:58 +02:00
net: core: page_pool: add user refcnt and reintroduce page_pool_destroy
2019-07-08 14:58:04 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to action dev before calling offloads
2019-08-26 14:17:43 -07:00
Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net
2019-09-17 23:51:10 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: sched: take reference to psample group in flow_action infra
2019-09-16 09:18:03 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
2019-10-09 21:34:31 -07:00
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
net: Rename net/nexthop.h net/rtnh.h
2019-04-22 21:47:25 -07:00
sch_netem: fix rcu splat in netem_enqueue()
2019-09-27 10:29:11 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/smc: add smcd support to the pnet table
2019-02-21 10:34:37 -08:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
udp: correct reuseport selection with connected sockets
2019-09-16 09:02:18 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp: annotate sk->sk_rcvbuf lockless reads
2019-10-13 10:13:08 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
net/tls: clean up the number of #ifdefs for CONFIG_TLS_DEVICE
2019-09-05 09:49:49 +02:00
udp: Remove unlikely() from IS_ERR*() condition
2019-08-30 19:49:37 -07:00
ipv6: Move ipv6 stubs to a separate header file
2019-03-29 10:53:45 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321
2019-06-05 17:37:05 +02:00
vxlan: add adjacent link to limit depth level
2019-10-24 14:53:49 -07:00
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268
2019-06-05 17:30:29 +02:00
xdp: page_pool related fix to cpumap
2019-06-19 11:23:13 -04:00
xdp: add tracepoints for XDP mem
2019-06-19 11:23:13 -04:00
xsk: add support to allow unaligned chunk placement
2019-08-31 01:08:26 +02:00
xfrm interface: fix management of phydev
2019-07-17 10:03:54 +02:00
20eb4f29b6