Skip to content

Commit 3224744

Browse files
kuba-mookuba-moo
committed
Merge branch 'rxrpc-miscellaneous-fixes'
David Howells says: ==================== rxrpc: Miscellaneous fixes Here are some fixes for rxrpc: (1) Fix the calling of IP routing code with IRQs disabled. (2) Fix a recvmsg/recvmsg race when the first completes a call. (3) Fix a race between notification, recvmsg and sendmsg releasing a call. (4) Fix abort of abort. (5) Fix call-level aborts that should be connection-level aborts. ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents 88b06e4 + f029567 commit 3224744

File tree

9 files changed

+83
-42
lines changed

9 files changed

+83
-42
lines changed

‎include/trace/events/rxrpc.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,20 +322,24 @@
322322
EM(rxrpc_call_put_kernel, "PUT kernel ") \
323323
EM(rxrpc_call_put_poke, "PUT poke ") \
324324
EM(rxrpc_call_put_recvmsg, "PUT recvmsg ") \
325+
EM(rxrpc_call_put_release_recvmsg_q, "PUT rls-rcmq") \
325326
EM(rxrpc_call_put_release_sock, "PUT rls-sock") \
326327
EM(rxrpc_call_put_release_sock_tba, "PUT rls-sk-a") \
327328
EM(rxrpc_call_put_sendmsg, "PUT sendmsg ") \
328-
EM(rxrpc_call_put_unnotify, "PUT unnotify") \
329329
EM(rxrpc_call_put_userid_exists, "PUT u-exists") \
330330
EM(rxrpc_call_put_userid, "PUT user-id ") \
331331
EM(rxrpc_call_see_accept, "SEE accept ") \
332332
EM(rxrpc_call_see_activate_client, "SEE act-clnt") \
333+
EM(rxrpc_call_see_already_released, "SEE alrdy-rl") \
333334
EM(rxrpc_call_see_connect_failed, "SEE con-fail") \
334335
EM(rxrpc_call_see_connected, "SEE connect ") \
335336
EM(rxrpc_call_see_conn_abort, "SEE conn-abt") \
337+
EM(rxrpc_call_see_discard, "SEE discard ") \
336338
EM(rxrpc_call_see_disconnected, "SEE disconn ") \
337339
EM(rxrpc_call_see_distribute_error, "SEE dist-err") \
338340
EM(rxrpc_call_see_input, "SEE input ") \
341+
EM(rxrpc_call_see_notify_released, "SEE nfy-rlsd") \
342+
EM(rxrpc_call_see_recvmsg, "SEE recvmsg ") \
339343
EM(rxrpc_call_see_release, "SEE release ") \
340344
EM(rxrpc_call_see_userid_exists, "SEE u-exists") \
341345
EM(rxrpc_call_see_waiting_call, "SEE q-conn ") \

‎net/rxrpc/ar-internal.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ enum rxrpc_skb_mark {
4444
RXRPC_SKB_MARK_SERVICE_CONN_SECURED, /* Service connection response has been verified */
4545
RXRPC_SKB_MARK_REJECT_BUSY, /* Reject with BUSY */
4646
RXRPC_SKB_MARK_REJECT_ABORT, /* Reject with ABORT (code in skb->priority) */
47+
RXRPC_SKB_MARK_REJECT_CONN_ABORT, /* Reject with connection ABORT (code in skb->priority) */
4748
};
4849

4950
/*
@@ -1253,6 +1254,8 @@ int rxrpc_encap_rcv(struct sock *, struct sk_buff *);
12531254
void rxrpc_error_report(struct sock *);
12541255
bool rxrpc_direct_abort(struct sk_buff *skb, enum rxrpc_abort_reason why,
12551256
s32 abort_code, int err);
1257+
bool rxrpc_direct_conn_abort(struct sk_buff *skb, enum rxrpc_abort_reason why,
1258+
s32 abort_code, int err);
12561259
int rxrpc_io_thread(void *data);
12571260
void rxrpc_post_response(struct rxrpc_connection *conn, struct sk_buff *skb);
12581261
static inline void rxrpc_wake_up_io_thread(struct rxrpc_local *local)
@@ -1383,6 +1386,7 @@ struct rxrpc_peer *rxrpc_lookup_peer_rcu(struct rxrpc_local *,
13831386
const struct sockaddr_rxrpc *);
13841387
struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *local,
13851388
struct sockaddr_rxrpc *srx, gfp_t gfp);
1389+
void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer);
13861390
struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *, gfp_t,
13871391
enum rxrpc_peer_trace);
13881392
void rxrpc_new_incoming_peer(struct rxrpc_local *local, struct rxrpc_peer *peer);

‎net/rxrpc/call_accept.c‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
219219
tail = b->call_backlog_tail;
220220
while (CIRC_CNT(head, tail, size) > 0) {
221221
struct rxrpc_call *call = b->call_backlog[tail];
222+
rxrpc_see_call(call, rxrpc_call_see_discard);
222223
rcu_assign_pointer(call->socket, rx);
223224
if (rx->app_ops &&
224225
rx->app_ops->discard_new_call) {
@@ -373,8 +374,8 @@ bool rxrpc_new_incoming_call(struct rxrpc_local *local,
373374
spin_lock(&rx->incoming_lock);
374375
if (rx->sk.sk_state == RXRPC_SERVER_LISTEN_DISABLED ||
375376
rx->sk.sk_state == RXRPC_CLOSE) {
376-
rxrpc_direct_abort(skb, rxrpc_abort_shut_down,
377-
RX_INVALID_OPERATION, -ESHUTDOWN);
377+
rxrpc_direct_conn_abort(skb, rxrpc_abort_shut_down,
378+
RX_INVALID_OPERATION, -ESHUTDOWN);
378379
goto no_call;
379380
}
380381

@@ -406,6 +407,7 @@ bool rxrpc_new_incoming_call(struct rxrpc_local *local,
406407

407408
spin_unlock(&rx->incoming_lock);
408409
read_unlock_irq(&local->services_lock);
410+
rxrpc_assess_MTU_size(local, call->peer);
409411

410412
if (hlist_unhashed(&call->error_link)) {
411413
spin_lock_irq(&call->peer->lock);
@@ -420,12 +422,12 @@ bool rxrpc_new_incoming_call(struct rxrpc_local *local,
420422

421423
unsupported_service:
422424
read_unlock_irq(&local->services_lock);
423-
return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
424-
RX_INVALID_OPERATION, -EOPNOTSUPP);
425+
return rxrpc_direct_conn_abort(skb, rxrpc_abort_service_not_offered,
426+
RX_INVALID_OPERATION, -EOPNOTSUPP);
425427
unsupported_security:
426428
read_unlock_irq(&local->services_lock);
427-
return rxrpc_direct_abort(skb, rxrpc_abort_service_not_offered,
428-
RX_INVALID_OPERATION, -EKEYREJECTED);
429+
return rxrpc_direct_conn_abort(skb, rxrpc_abort_service_not_offered,
430+
RX_INVALID_OPERATION, -EKEYREJECTED);
429431
no_call:
430432
spin_unlock(&rx->incoming_lock);
431433
read_unlock_irq(&local->services_lock);

‎net/rxrpc/call_object.c‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -561,7 +561,7 @@ static void rxrpc_cleanup_rx_buffers(struct rxrpc_call *call)
561561
void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
562562
{
563563
struct rxrpc_connection *conn = call->conn;
564-
bool put = false, putu = false;
564+
bool putu = false;
565565

566566
_enter("{%d,%d}", call->debug_id, refcount_read(&call->ref));
567567

@@ -573,23 +573,13 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
573573

574574
rxrpc_put_call_slot(call);
575575

576-
/* Make sure we don't get any more notifications */
576+
/* Note that at this point, the call may still be on or may have been
577+
* added back on to the socket receive queue. recvmsg() must discard
578+
* released calls. The CALL_RELEASED flag should prevent further
579+
* notifications.
580+
*/
577581
spin_lock_irq(&rx->recvmsg_lock);
578-
579-
if (!list_empty(&call->recvmsg_link)) {
580-
_debug("unlinking once-pending call %p { e=%lx f=%lx }",
581-
call, call->events, call->flags);
582-
list_del(&call->recvmsg_link);
583-
put = true;
584-
}
585-
586-
/* list_empty() must return false in rxrpc_notify_socket() */
587-
call->recvmsg_link.next = NULL;
588-
call->recvmsg_link.prev = NULL;
589-
590582
spin_unlock_irq(&rx->recvmsg_lock);
591-
if (put)
592-
rxrpc_put_call(call, rxrpc_call_put_unnotify);
593583

594584
write_lock(&rx->call_lock);
595585

@@ -638,6 +628,12 @@ void rxrpc_release_calls_on_socket(struct rxrpc_sock *rx)
638628
rxrpc_put_call(call, rxrpc_call_put_release_sock);
639629
}
640630

631+
while ((call = list_first_entry_or_null(&rx->recvmsg_q,
632+
struct rxrpc_call, recvmsg_link))) {
633+
list_del_init(&call->recvmsg_link);
634+
rxrpc_put_call(call, rxrpc_call_put_release_recvmsg_q);
635+
}
636+
641637
_leave("");
642638
}
643639

‎net/rxrpc/io_thread.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,20 @@ bool rxrpc_direct_abort(struct sk_buff *skb, enum rxrpc_abort_reason why,
9797
return false;
9898
}
9999

100+
/*
101+
* Directly produce a connection abort from a packet.
102+
*/
103+
bool rxrpc_direct_conn_abort(struct sk_buff *skb, enum rxrpc_abort_reason why,
104+
s32 abort_code, int err)
105+
{
106+
struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
107+
108+
trace_rxrpc_abort(0, why, sp->hdr.cid, 0, sp->hdr.seq, abort_code, err);
109+
skb->mark = RXRPC_SKB_MARK_REJECT_CONN_ABORT;
110+
skb->priority = abort_code;
111+
return false;
112+
}
113+
100114
static bool rxrpc_bad_message(struct sk_buff *skb, enum rxrpc_abort_reason why)
101115
{
102116
return rxrpc_direct_abort(skb, why, RX_PROTOCOL_ERROR, -EBADMSG);

‎net/rxrpc/output.c‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -814,6 +814,9 @@ void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
814814
__be32 code;
815815
int ret, ioc;
816816

817+
if (sp->hdr.type == RXRPC_PACKET_TYPE_ABORT)
818+
return; /* Never abort an abort. */
819+
817820
rxrpc_see_skb(skb, rxrpc_skb_see_reject);
818821

819822
iov[0].iov_base = &whdr;
@@ -826,14 +829,23 @@ void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
826829
msg.msg_controllen = 0;
827830
msg.msg_flags = 0;
828831

829-
memset(&whdr, 0, sizeof(whdr));
832+
whdr = (struct rxrpc_wire_header) {
833+
.epoch = htonl(sp->hdr.epoch),
834+
.cid = htonl(sp->hdr.cid),
835+
.callNumber = htonl(sp->hdr.callNumber),
836+
.serviceId = htons(sp->hdr.serviceId),
837+
.flags = ~sp->hdr.flags & RXRPC_CLIENT_INITIATED,
838+
};
830839

831840
switch (skb->mark) {
832841
case RXRPC_SKB_MARK_REJECT_BUSY:
833842
whdr.type = RXRPC_PACKET_TYPE_BUSY;
834843
size = sizeof(whdr);
835844
ioc = 1;
836845
break;
846+
case RXRPC_SKB_MARK_REJECT_CONN_ABORT:
847+
whdr.callNumber = 0;
848+
fallthrough;
837849
case RXRPC_SKB_MARK_REJECT_ABORT:
838850
whdr.type = RXRPC_PACKET_TYPE_ABORT;
839851
code = htonl(skb->priority);
@@ -847,14 +859,6 @@ void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
847859
if (rxrpc_extract_addr_from_skb(&srx, skb) == 0) {
848860
msg.msg_namelen = srx.transport_len;
849861

850-
whdr.epoch = htonl(sp->hdr.epoch);
851-
whdr.cid = htonl(sp->hdr.cid);
852-
whdr.callNumber = htonl(sp->hdr.callNumber);
853-
whdr.serviceId = htons(sp->hdr.serviceId);
854-
whdr.flags = sp->hdr.flags;
855-
whdr.flags ^= RXRPC_CLIENT_INITIATED;
856-
whdr.flags &= RXRPC_CLIENT_INITIATED;
857-
858862
iov_iter_kvec(&msg.msg_iter, WRITE, iov, ioc, size);
859863
ret = do_udp_sendmsg(local->socket, &msg, size);
860864
if (ret < 0)

‎net/rxrpc/peer_object.c‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,7 @@ struct rxrpc_peer *rxrpc_lookup_peer_rcu(struct rxrpc_local *local,
149149
* assess the MTU size for the network interface through which this peer is
150150
* reached
151151
*/
152-
static void rxrpc_assess_MTU_size(struct rxrpc_local *local,
153-
struct rxrpc_peer *peer)
152+
void rxrpc_assess_MTU_size(struct rxrpc_local *local, struct rxrpc_peer *peer)
154153
{
155154
struct net *net = local->net;
156155
struct dst_entry *dst;
@@ -277,8 +276,6 @@ static void rxrpc_init_peer(struct rxrpc_local *local, struct rxrpc_peer *peer,
277276

278277
peer->hdrsize += sizeof(struct rxrpc_wire_header);
279278
peer->max_data = peer->if_mtu - peer->hdrsize;
280-
281-
rxrpc_assess_MTU_size(local, peer);
282279
}
283280

284281
/*
@@ -297,6 +294,7 @@ static struct rxrpc_peer *rxrpc_create_peer(struct rxrpc_local *local,
297294
if (peer) {
298295
memcpy(&peer->srx, srx, sizeof(*srx));
299296
rxrpc_init_peer(local, peer, hash_key);
297+
rxrpc_assess_MTU_size(local, peer);
300298
}
301299

302300
_leave(" = %p", peer);

‎net/rxrpc/recvmsg.c‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ void rxrpc_notify_socket(struct rxrpc_call *call)
2929

3030
if (!list_empty(&call->recvmsg_link))
3131
return;
32+
if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
33+
rxrpc_see_call(call, rxrpc_call_see_notify_released);
34+
return;
35+
}
3236

3337
rcu_read_lock();
3438

@@ -447,6 +451,16 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
447451
goto try_again;
448452
}
449453

454+
rxrpc_see_call(call, rxrpc_call_see_recvmsg);
455+
if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
456+
rxrpc_see_call(call, rxrpc_call_see_already_released);
457+
list_del_init(&call->recvmsg_link);
458+
spin_unlock_irq(&rx->recvmsg_lock);
459+
release_sock(&rx->sk);
460+
trace_rxrpc_recvmsg(call->debug_id, rxrpc_recvmsg_unqueue, 0);
461+
rxrpc_put_call(call, rxrpc_call_put_recvmsg);
462+
goto try_again;
463+
}
450464
if (!(flags & MSG_PEEK))
451465
list_del_init(&call->recvmsg_link);
452466
else
@@ -470,8 +484,13 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
470484

471485
release_sock(&rx->sk);
472486

473-
if (test_bit(RXRPC_CALL_RELEASED, &call->flags))
474-
BUG();
487+
if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
488+
rxrpc_see_call(call, rxrpc_call_see_already_released);
489+
mutex_unlock(&call->user_mutex);
490+
if (!(flags & MSG_PEEK))
491+
rxrpc_put_call(call, rxrpc_call_put_recvmsg);
492+
goto try_again;
493+
}
475494

476495
ret = rxrpc_recvmsg_user_id(call, msg, flags);
477496
if (ret < 0)

‎net/rxrpc/security.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,15 +140,15 @@ const struct rxrpc_security *rxrpc_get_incoming_security(struct rxrpc_sock *rx,
140140

141141
sec = rxrpc_security_lookup(sp->hdr.securityIndex);
142142
if (!sec) {
143-
rxrpc_direct_abort(skb, rxrpc_abort_unsupported_security,
144-
RX_INVALID_OPERATION, -EKEYREJECTED);
143+
rxrpc_direct_conn_abort(skb, rxrpc_abort_unsupported_security,
144+
RX_INVALID_OPERATION, -EKEYREJECTED);
145145
return NULL;
146146
}
147147

148148
if (sp->hdr.securityIndex != RXRPC_SECURITY_NONE &&
149149
!rx->securities) {
150-
rxrpc_direct_abort(skb, rxrpc_abort_no_service_key,
151-
sec->no_key_abort, -EKEYREJECTED);
150+
rxrpc_direct_conn_abort(skb, rxrpc_abort_no_service_key,
151+
sec->no_key_abort, -EKEYREJECTED);
152152
return NULL;
153153
}
154154

0 commit comments

Comments
 (0)