linux-toradex.git/net/tipc, branch v3.4.71

tipc: fix lockdep warning during bearer initialization

2013-09-14T13:02:11+00:00

[ Upstream commit 4225a398c1352a7a5c14dc07277cb5cc4473983b ]

When the lockdep validator is enabled, it will report the below
warning when we enable a TIPC bearer:

[ INFO: possible irq lock inversion dependency detected ]
---------------------------------------------------------
Possible interrupt unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(ptype_lock);
                                local_irq_disable();
                                lock(tipc_net_lock);
                                lock(ptype_lock);
   
   lock(tipc_net_lock);

  *** DEADLOCK ***

the shortest dependencies between 2nd lock and 1st lock:
  -> (ptype_lock){+.+...} ops: 10 {
[...]
SOFTIRQ-ON-W at:
                      [] __lock_acquire+0x528/0x13e0
                      [] lock_acquire+0x90/0x100
                      [] _raw_spin_lock+0x38/0x50
                      [] dev_add_pack+0x3a/0x60
                      [] arp_init+0x1a/0x48
                      [] inet_init+0x181/0x27e
                      [] do_one_initcall+0x34/0x170
                      [] kernel_init+0x110/0x1b2
                      [] kernel_thread_helper+0x6/0x10
[...]
   ... key      at: [] ptype_lock+0x10/0x20
   ... acquired at:
    [] lock_acquire+0x90/0x100
    [] _raw_spin_lock+0x38/0x50
    [] dev_add_pack+0x3a/0x60
    [] enable_bearer+0xf2/0x140 [tipc]
    [] tipc_enable_bearer+0x1ba/0x450 [tipc]
    [] tipc_cfg_do_cmd+0x5c4/0x830 [tipc]
    [] handle_cmd+0x42/0xd0 [tipc]
    [] genl_rcv_msg+0x232/0x280
    [] netlink_rcv_skb+0x86/0xb0
    [] genl_rcv+0x1c/0x30
    [] netlink_unicast+0x174/0x1f0
    [] netlink_sendmsg+0x1eb/0x2d0
    [] sock_aio_write+0x161/0x170
    [] do_sync_write+0xac/0xf0
    [] vfs_write+0x156/0x170
    [] sys_write+0x42/0x70
    [] sysenter_do_call+0x12/0x38
[...]
}
  -> (tipc_net_lock){+..-..} ops: 4 {
[...]
    IN-SOFTIRQ-R at:
                     [] __lock_acquire+0x64a/0x13e0
                     [] lock_acquire+0x90/0x100
                     [] _raw_read_lock_bh+0x3d/0x50
                     [] tipc_recv_msg+0x1d/0x830 [tipc]
                     [] recv_msg+0x3f/0x50 [tipc]
                     [] __netif_receive_skb+0x22a/0x590
                     [] netif_receive_skb+0x2b/0xf0
                     [] pcnet32_poll+0x292/0x780
                     [] net_rx_action+0xfa/0x1e0
                     [] __do_softirq+0xae/0x1e0
[...]
}

>From the log, we can see three different call chains between
CPU0 and CPU1:

Time 0 on CPU0:

  kernel_init()->inet_init()->dev_add_pack()

At time 0, the ptype_lock is held by CPU0 in dev_add_pack();

Time 1 on CPU1:

  tipc_enable_bearer()->enable_bearer()->dev_add_pack()

At time 1, tipc_enable_bearer() first holds tipc_net_lock, and then
wants to take ptype_lock to register TIPC protocol handler into the
networking stack.  But the ptype_lock has been taken by dev_add_pack()
on CPU0, so at this time the dev_add_pack() running on CPU1 has to be
busy looping.

Time 2 on CPU0:

  netif_receive_skb()->recv_msg()->tipc_recv_msg()

At time 2, an incoming TIPC packet arrives at CPU0, hence
tipc_recv_msg() will be invoked. In tipc_recv_msg(), it first wants
to hold tipc_net_lock.  At the moment, below scenario happens:

On CPU0, below is our sequence of taking locks:

  lock(ptype_lock)->lock(tipc_net_lock)

On CPU1, our sequence of taking locks looks like:

  lock(tipc_net_lock)->lock(ptype_lock)

Obviously deadlock may happen in this case.

But please note the deadlock possibly doesn't occur at all when the
first TIPC bearer is enabled.  Before enable_bearer() -- running on
CPU1 does not hold ptype_lock, so the TIPC receive handler (i.e.
recv_msg()) is not registered successfully via dev_add_pack(), so
the tipc_recv_msg() cannot be called by recv_msg() even if a TIPC
message comes to CPU0. But when the second TIPC bearer is
registered, the deadlock can perhaps really happen.

To fix it, we will push the work of registering TIPC protocol
handler into workqueue context. After the change, both paths taking
ptype_lock are always in process contexts, thus, the deadlock should
never occur.

Signed-off-by: Ying Xue 
Signed-off-by: Jon Maloy 
Signed-off-by: Paul Gortmaker 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tipc: fix info leaks via msg_name in recv_msg/recv_stream

2013-05-01T16:41:05+00:00

[ Upstream commit 60085c3d009b0df252547adb336d1ccca5ce52ec ]

The code in set_orig_addr() does not initialize all of the members of
struct sockaddr_tipc when filling the sockaddr info -- namely the union
is only partly filled. This will make recv_msg() and recv_stream() --
the only users of this function -- leak kernel stack memory as the
msg_name member is a local variable in net/socket.c.

Additionally to that both recv_msg() and recv_stream() fail to update
the msg_namelen member to 0 while otherwise returning with 0, i.e.
"success". This is the case for, e.g., non-blocking sockets. This will
lead to a 128 byte kernel stack leak in net/socket.c.

Fix the first issue by initializing the memory of the union with
memset(0). Fix the second one by setting msg_namelen to 0 early as it
will be updated later if we're going to fill the msg_name member.

Signed-off-by: Mathias Krause 
Cc: Jon Maloy 
Cc: Allan Stephens 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tipc: Optimize setting of immutable payload message header fields

2012-02-29T16:45:35+00:00

Optimizes routines that send payload messages so that they no longer
update the "originating node" and "originating port" fields of the
outgoing message header template, since these fields are initialized
when the sending port is created and never change thereafter. Also
optimizes the routine which updates the message header template when
a connection to a port is established, for the same reason.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Eliminate obsolete code for re-sending a message

2012-02-29T16:45:01+00:00

Removes code that updated the "previous node" field of an out-going
message over TIPC's links. Such updating is unnecessary since the
removal of the prototype multi-cluster capability means that all
outgoing messages are generated locally and already have this field
populated correctly.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Un-inline port routine for processing incoming messages

2012-02-29T16:44:32+00:00

Converts a non-trivial routine from inline to non-inline form
to avoid bloating the TIPC code base with 6 copies of its body.

This change is essentially cosmetic, and doesn't change existing
TIPC behavior.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Eliminate support for tipc_mode global variable

2012-02-24T22:05:17+00:00

Removes all references to the global variable that records whether
TIPC is running in "single node" mode or "network" mode, since this
information can be easily deduced from the global variable that
records TIPC's network address. (i.e. a non-zero network address
means that TIPC is running in network mode.)

The changes made update most existing mode-based checks to use the
network address global variable. A few checks that are no longer
needed are removed entirely, along with any associated code lying on
non-executable control paths.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Eliminate obsolete support for "not running" mode

2012-02-24T22:05:17+00:00

Removes all references to TIPC's "not running" mode, since the
removal of support for the native API means that there is no longer
any way to interact with TIPC if it has not been initialized.

The changes made consist of removing mode-based checks that are no
longer needed, along with any associated code lying on non-executable
control paths.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Revert name table translation optimization

2012-02-24T22:05:17+00:00

Restores name table translation using a non-zero domain that is
"out of scope", which was broken by an earlier commit
(5d9c54c1e9ececcf7e99c4f014f9bec7ee3a7def). Comments have now been
added to the name table translation routine to make it clear that
there are actually three possible outcomes to a translation request
(found/not found/deferred), rather than just two (found/not found).

Note that a straightforward revert of the earlier commit is not
possible, as other changes to the name table translation logic
have occurred since the incorrect optimization was made.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Minor optimization to broadcast link synchronization logic

2012-02-24T22:05:16+00:00

Optimizes processing done when contact with a neighboring node is
established to avoid recording the current state of outgoing broadcast
messages if the neighboring node isn't a valid broadcast link destination,
since this state information isn't needed for such nodes.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker

tipc: Remove obsolete comments about routing table updates

2012-02-24T22:05:16+00:00

Eliminates a block of comments that describe how routing table updates
are to be handled. These comments no longer apply following the removal
of TIPC's prototype multi-cluster support.

Note that these changes are essentially cosmetic in nature, and have
no impact on the actual operation of TIPC.

Signed-off-by: Allan Stephens 
Signed-off-by: Paul Gortmaker