Commit 37436d9c authored by Ying Xue's avatar Ying Xue Committed by David S. Miller

tipc: fix an interrupt unsafe locking scenario

Commit 9faa89d4 ("tipc: make function tipc_net_finalize() thread
safe") tries to make it thread safe to set node address, so it uses
node_list_lock lock to serialize the whole process of setting node
address in tipc_net_finalize(). But it causes the following interrupt
unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rht_deferred_worker()
  rhashtable_rehash_table()
  lock(&(&ht->lock)->rlock)
			       tipc_nl_compat_doit()
                               tipc_net_finalize()
                               local_irq_disable();
                               lock(&(&tn->node_list_lock)->rlock);
                               tipc_sk_reinit()
                               rhashtable_walk_enter()
                               lock(&(&ht->lock)->rlock);
  <Interrupt>
  tipc_disc_rcv()
  tipc_node_check_dest()
  tipc_node_create()
  lock(&(&tn->node_list_lock)->rlock);

 *** DEADLOCK ***

When rhashtable_rehash_table() holds ht->lock on CPU0, it doesn't
disable BH. So if an interrupt happens after the lock, it can create
an inverse lock ordering between ht->lock and tn->node_list_lock. As
a consequence, deadlock might happen.

The reason causing the inverse lock ordering scenario above is because
the initial purpose of node_list_lock is not designed to do the
serialization of node address setting.

As cmpxchg() can guarantee CAS (compare-and-swap) process is atomic,
we use it to replace node_list_lock to ensure setting node address can
be atomically finished. It turns out the potential deadlock can be
avoided as well.

Fixes: 9faa89d4 ("tipc: make function tipc_net_finalize() thread safe")
Signed-off-by: default avatarYing Xue <ying.xue@windriver.com>
Acked-by: default avatarJon Maloy <maloy@donjonn.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 455f05ec
...@@ -123,15 +123,13 @@ void tipc_net_finalize(struct net *net, u32 addr) ...@@ -123,15 +123,13 @@ void tipc_net_finalize(struct net *net, u32 addr)
{ {
struct tipc_net *tn = tipc_net(net); struct tipc_net *tn = tipc_net(net);
spin_lock_bh(&tn->node_list_lock); if (!cmpxchg(&tn->node_addr, 0, addr)) {
if (!tipc_own_addr(net)) {
tipc_set_node_addr(net, addr); tipc_set_node_addr(net, addr);
tipc_named_reinit(net); tipc_named_reinit(net);
tipc_sk_reinit(net); tipc_sk_reinit(net);
tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr,
TIPC_CLUSTER_SCOPE, 0, addr); TIPC_CLUSTER_SCOPE, 0, addr);
} }
spin_unlock_bh(&tn->node_list_lock);
} }
void tipc_net_stop(struct net *net) void tipc_net_stop(struct net *net)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment