• Eric Dumazet's avatar
    tcp: fix hang in tcp_sendpage_locked() · bd9dfc54
    Eric Dumazet authored
    syszkaller got a hang in tcp stack, related to a bug in
    tcp_sendpage_locked()
    
    root@syzkaller:~# cat /proc/3059/stack
    [<ffffffff83de926c>] __lock_sock+0x1dc/0x2f0
    [<ffffffff83de9473>] lock_sock_nested+0xf3/0x110
    [<ffffffff8408ce01>] tcp_sendmsg+0x21/0x50
    [<ffffffff84163b6f>] inet_sendmsg+0x11f/0x5e0
    [<ffffffff83dd8eea>] sock_sendmsg+0xca/0x110
    [<ffffffff83dd9547>] kernel_sendmsg+0x47/0x60
    [<ffffffff83de35dc>] sock_no_sendpage+0x1cc/0x280
    [<ffffffff8408916b>] tcp_sendpage_locked+0x10b/0x160
    [<ffffffff84089203>] tcp_sendpage+0x43/0x60
    [<ffffffff841641da>] inet_sendpage+0x1aa/0x660
    [<ffffffff83dd4fcd>] kernel_sendpage+0x8d/0xe0
    [<ffffffff83dd50ac>] sock_sendpage+0x8c/0xc0
    [<ffffffff81b63300>] pipe_to_sendpage+0x290/0x3b0
    [<ffffffff81b67243>] __splice_from_pipe+0x343/0x750
    [<ffffffff81b6a459>] splice_from_pipe+0x1e9/0x330
    [<ffffffff81b6a5e0>] generic_splice_sendpage+0x40/0x50
    [<ffffffff81b6b1d7>] SyS_splice+0x7b7/0x1610
    [<ffffffff84d77a01>] entry_SYSCALL_64_fastpath+0x1f/0xbe
    
    Fixes: 306b13eb ("proto_ops: Add locked held versions of sendmsg and sendpage")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: Tom Herbert <tom@quantonium.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    bd9dfc54
tcp.c 91.1 KB