From: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> Date: Wed, 2 Sep 2020 22:44:16 +0900
> syzbot is reporting hung task at nbd_ioctl() [1], for there are two > problems regarding TIPC's connectionless socket's shutdown() operation. ... > One problem is that wait_for_completion() from flush_workqueue() from > nbd_start_device_ioctl() from nbd_ioctl() cannot be completed when > nbd_start_device_ioctl() received a signal at wait_event_interruptible(), > for tipc_shutdown() from kernel_sock_shutdown(SHUT_RDWR) from > nbd_mark_nsock_dead() from sock_shutdown() from nbd_start_device_ioctl() > is failing to wake up a WQ thread sleeping at wait_woken() from > tipc_wait_for_rcvmsg() from sock_recvmsg() from sock_xmit() from > nbd_read_stat() from recv_work() scheduled by nbd_start_device() from > nbd_start_device_ioctl(). Fix this problem by always invoking > sk->sk_state_change() (like inet_shutdown() does) when tipc_shutdown() is > called. > > The other problem is that tipc_wait_for_rcvmsg() cannot return when > tipc_shutdown() is called, for tipc_shutdown() sets sk->sk_shutdown to > SEND_SHUTDOWN (despite "how" is SHUT_RDWR) while tipc_wait_for_rcvmsg() > needs sk->sk_shutdown set to RCV_SHUTDOWN or SHUTDOWN_MASK. Fix this > problem by setting sk->sk_shutdown to SHUTDOWN_MASK (like inet_shutdown() > does) when the socket is connectionless. > > [1] > https://syzkaller.appspot.com/bug?id=3fe51d307c1f0a845485cf1798aa059d12bf18b2 > > Reported-by: syzbot <syzbot+e36f41d207137b5d1...@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> Applied and queued up for -stable, thank you. _______________________________________________ tipc-discussion mailing list tipc-discussion@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tipc-discussion
