mirror-linux/net/tipc
Chengfeng Ye 143e72757a tipc: fix a potential deadlock on &tx->lock
[ Upstream commit 08e50cf071 ]

It seems that tipc_crypto_key_revoke() could be be invoked by
wokequeue tipc_crypto_work_rx() under process context and
timer/rx callback under softirq context, thus the lock acquisition
on &tx->lock seems better use spin_lock_bh() to prevent possible
deadlock.

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

tipc_crypto_work_rx() <workqueue>
--> tipc_crypto_key_distr()
--> tipc_bcast_xmit()
--> tipc_bcbase_xmit()
--> tipc_bearer_bc_xmit()
--> tipc_crypto_xmit()
--> tipc_ehdr_build()
--> tipc_crypto_key_revoke()
--> spin_lock(&tx->lock)
<timer interrupt>
   --> tipc_disc_timeout()
   --> tipc_bearer_xmit_skb()
   --> tipc_crypto_xmit()
   --> tipc_ehdr_build()
   --> tipc_crypto_key_revoke()
   --> spin_lock(&tx->lock) <deadlock here>

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-10 22:00:43 +02:00
..
Kconfig
Makefile
addr.c
addr.h
bcast.c
bcast.h
bearer.c net: tipc: resize nlattr array to correct size 2023-06-21 16:01:02 +02:00
bearer.h
core.c
core.h
crypto.c tipc: fix a potential deadlock on &tx->lock 2023-10-10 22:00:43 +02:00
crypto.h
diag.c
discover.c
discover.h
eth_media.c
group.c
group.h
ib_media.c
link.c tipc: do not update mtu if msg_max is too small in mtu negotiation 2023-05-24 17:32:46 +01:00
link.h
monitor.c
monitor.h
msg.c
msg.h
name_distr.c
name_distr.h
name_table.c
name_table.h
net.c
net.h
netlink.c
netlink.h
netlink_compat.c
node.c tipc: stop tipc crypto on failure in tipc_node_create 2023-08-03 10:24:02 +02:00
node.h
socket.c
socket.h
subscr.c
subscr.h
sysctl.c
topsrv.c
topsrv.h
trace.c
trace.h
udp_media.c
udp_media.h