• Erez Shitrit's avatar
    IB/IPoIB: Fix race between ipoib_remove_one to sysfs functions · 198b12f7
    Erez Shitrit authored
    In ipoib_remove_one the driver holds the rtnl_lock and tries to do some
    operation like dev_change_flags or unregister_netdev, while sysfs
    callback like ipoib_vlan_delete holds sysfs mutex and tries to hold the
    rtnl_lock via rtnl_trylock() and restart_syscall() if the lock is not
    free, meanwhile ipoib_remove_one tries to get the sysfs lock in order to
    free its sysfs directory, and we will get  a->b, b->a deadlock.
    
        Trace like the following:
    
            schedule+0x37/0x80
            schedule_preempt_disabled+0xe/0x10
            __mutex_lock_slowpath+0xb5/0x120
            mutex_lock+0x23/0x40
            rtnl_lock+0x15/0x20
            netdev_run_todo+0x17c/0x320
            rtnl_unlock+0xe/0x10
            ipoib_vlan_delete+0x11b/0x1b0 [ib_ipoib]
            delete_child+0x54/0x80 [ib_ipoib]
            dev_attr_store+0x18/0x30
            sysfs_kf_write+0x37/0x40
            mutex_lock+0x16/0x40
            SyS_write+0x55/0xc0
            entry_SYSCALL_64_fastpath+0x16/0x75
        And
            schedule+0x37/0x80
            __kernfs_remove+0x1a8/0x260
            ? wake_atomic_t_function+0x60/0x60
            kernfs_remove+0x25/0x40
            sysfs_remove_dir+0x50/0x80
            kobject_del+0x18/0x50
            device_del+0x19f/0x260
            netdev_unregister_kobject+0x6a/0x80
            rollback_registered_many+0x1fd/0x340
            rollback_registered+0x3c/0x70
            unregister_netdevice_queue+0x55/0xc0
            unregister_netdev+0x20/0x30
            ipoib_remove_one+0x114/0x1b0 [ib_ipoib]
            ib_unregister_client+0x4a/0x170 [ib_core]
            ? find_module_all+0x71/0xa0
            ipoib_cleanup_module+0x10/0x94 [ib_ipoib]
            SyS_delete_module+0x1b5/0x210
            entry_SYSCALL_64_fastpath+0x16/0x75
    
    The fix is by checking the flag IPOIB_FLAG_INTF_ON_DESTROY in order to
    get out from the sysfs function.
    
    Fixes: 862096a8 ("IB/ipoib: Add more rtnl_link_ops callbacks")
    Fixes: 9baa0b03 ("IB/ipoib: Add rtnl_link_ops support")
    Signed-off-by: default avatarErez Shitrit <erezsh@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    198b12f7
ipoib_vlan.c 5.41 KB