Parthasarathy Bhuvaragan
458be024ef
tipc: remove subscription references only for pending timers
...
In commit, 139bb36f75 ("tipc: advance the time of deleting
subscription from subscriber->subscrp_list"), we delete the
subscription from the subscribers list and from nametable
unconditionally. This leads to the following bug if the timer
running tipc_subscrp_timeout() in another CPU accesses the
subscription list after the subscription delete request.
[39.570] general protection fault: 0000 [#1 ] SMP
::
[39.574] task: ffffffff81c10540 task.stack: ffffffff81c00000
[39.575] RIP: 0010:tipc_subscrp_timeout+0x32/0x80 [tipc]
[39.576] RSP: 0018:ffff88003ba03e90 EFLAGS: 00010282
[39.576] RAX: dead000000000200 RBX: ffff88003f0f3600 RCX: 0000000000000101
[39.577] RDX: dead000000000100 RSI: 0000000000000201 RDI: ffff88003f0d7948
[39.578] RBP: ffff88003ba03ea0 R08: 0000000000000001 R09: ffff88003ba03ef8
[39.579] R10: 000000000000014f R11: 0000000000000000 R12: ffff88003f0d7948
[39.580] R13: ffff88003f0f3618 R14: ffffffffa006c250 R15: ffff88003f0f3600
[39.581] FS: 0000000000000000(0000) GS:ffff88003ba00000(0000) knlGS:0000000000000000
[39.582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[39.583] CR2: 00007f831c6e0714 CR3: 000000003d3b0000 CR4: 00000000000006f0
[39.584] Call Trace:
[39.584] <IRQ>
[39.585] call_timer_fn+0x3d/0x180
[39.585] ? tipc_subscrb_rcv_cb+0x260/0x260 [tipc]
[39.586] run_timer_softirq+0x168/0x1f0
[39.586] ? sched_clock_cpu+0x16/0xc0
[39.587] __do_softirq+0x9b/0x2de
[39.587] irq_exit+0x60/0x70
[39.588] smp_apic_timer_interrupt+0x3d/0x50
[39.588] apic_timer_interrupt+0x86/0x90
[39.589] RIP: 0010:default_idle+0x20/0xf0
[39.589] RSP: 0018:ffffffff81c03e58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
[39.590] RAX: 0000000000000000 RBX: ffffffff81c10540 RCX: 0000000000000000
[39.591] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[39.592] RBP: ffffffff81c03e68 R08: 0000000000000000 R09: 0000000000000000
[39.593] R10: ffffc90001cbbe00 R11: 0000000000000000 R12: 0000000000000000
[39.594] R13: ffffffff81c10540 R14: 0000000000000000 R15: 0000000000000000
[39.595] </IRQ>
::
[39.603] RIP: tipc_subscrp_timeout+0x32/0x80 [tipc] RSP: ffff88003ba03e90
[39.604] ---[ end trace 79ce94b7216cb459 ]---
Fixes: 139bb36f75 ("tipc: advance the time of deleting subscription from subscriber->subscrp_list")
Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-08-22 14:25:02 -07:00
arch
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
2017-08-21 14:07:48 -07:00
block
blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL
2017-08-18 08:08:14 -06:00
certs
modsign: add markers to endif-statements in certs/Makefile
2017-07-14 11:01:37 +10:00
crypto
crypto: authencesn - Fix digest_null crash
2017-07-18 17:01:11 +08:00
Documentation
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-08-21 13:16:27 -07:00
drivers
mlxsw: spectrum_switchdev: Fix mrouter flag update
2017-08-22 14:22:54 -07:00
firmware
firmware/Makefile: force recompilation if makefile changes
2017-05-08 17:15:10 -07:00
fs
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-08-20 09:36:52 -07:00
include
ipv6: add rcu grace period before freeing fib6_node
2017-08-22 11:03:19 -07:00
init
random: do not ignore early device randomness
2017-07-12 16:26:00 -07:00
ipc
ipc: add missing container_of()s for randstruct
2017-08-02 17:16:12 -07:00
kernel
pids: make task_tgid_nr_ns() safe
2017-08-21 12:47:31 -07:00
lib
kernel/watchdog: Prevent false positives with turbo modes
2017-08-18 12:35:02 +02:00
mm
Sanitize 'move_pages()' permission checks
2017-08-20 13:26:27 -07:00
net
tipc: remove subscription references only for pending timers
2017-08-22 14:25:02 -07:00
samples
samples/bpf: fix bpf tunnel cleanup
2017-07-31 22:02:47 -07:00
scripts
parse-maintainers: Move matching sections from MAINTAINERS
2017-08-08 11:16:14 -07:00
security
Now that IPC and other changes have landed, enable manual markings for
2017-07-19 08:55:18 -07:00
sound
ALSA: emu10k1: Fix forgotten user-copy conversion in init code
2017-08-18 10:59:02 +02:00
tools
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-08-21 13:16:27 -07:00
usr
ramfs: clarify help text that compression applies to ramfs as well as legacy ramdisk.
2017-07-06 16:24:30 -07:00
virt
KVM/ARM Fixes for v4.13-rc4
2017-08-03 17:59:58 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
kbuild: Add support to generate LLVM assembly files
2017-04-25 08:13:52 +09:00
.mailmap
power supply and reset changes for the v4.12 series (part 2)
2017-05-12 12:02:21 -07:00
COPYING
CREDITS
avr32: remove support for AVR32 architecture
2017-05-01 09:27:15 +02:00
Kbuild
kbuild: Consolidate header generation from ASM offset information
2017-04-13 05:43:37 +09:00
Kconfig
MAINTAINERS
Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-08-20 09:07:56 -07:00
Makefile
Linux 4.13-rc6
2017-08-20 14:13:52 -07:00
README
README: add a new README file, pointing to the Documentation/
2016-10-24 08:12:35 -02:00