sctp: fix sleep in atomic context bug in timer handlers
authorDuoming Zhou <duoming@zju.edu.cn>
Sat, 23 Jul 2022 01:58:09 +0000 (09:58 +0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 26 Jul 2022 02:39:05 +0000 (19:39 -0700)
commitb89fc26f741d9f9efb51cba3e9b241cf1380ec5a
tree47550b33acac21610b5832143f9e4b6488080f09
parentc7560d1203b7a1ea0b99a5c575547e95d564b2a8
sctp: fix sleep in atomic context bug in timer handlers

There are sleep in atomic context bugs in timer handlers of sctp
such as sctp_generate_t3_rtx_event(), sctp_generate_probe_event(),
sctp_generate_t1_init_event(), sctp_generate_timeout_event(),
sctp_generate_t3_rtx_event() and so on.

The root cause is sctp_sched_prio_init_sid() with GFP_KERNEL parameter
that may sleep could be called by different timer handlers which is in
interrupt context.

One of the call paths that could trigger bug is shown below:

      (interrupt context)
sctp_generate_probe_event
  sctp_do_sm
    sctp_side_effects
      sctp_cmd_interpreter
        sctp_outq_teardown
          sctp_outq_init
            sctp_sched_set_sched
              n->init_sid(..,GFP_KERNEL)
                sctp_sched_prio_init_sid //may sleep

This patch changes gfp_t parameter of init_sid in sctp_sched_set_sched()
from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic
context bugs.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://lore.kernel.org/r/20220723015809.11553-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/sctp/stream_sched.c