• Oleksij Rempel's avatar
    can: j1939: prevent deadlock by moving j1939_sk_errqueue() · d1366b28
    Oleksij Rempel authored
    This commit addresses a deadlock situation that can occur in certain
    scenarios, such as when running data TP/ETP transfer and subscribing to
    the error queue while receiving a net down event. The deadlock involves
    locks in the following order:
    
    3
      j1939_session_list_lock ->  active_session_list_lock
      j1939_session_activate
      ...
      j1939_sk_queue_activate_next -> sk_session_queue_lock
      ...
      j1939_xtp_rx_eoma_one
    
    2
      j1939_sk_queue_drop_all  ->  sk_session_queue_lock
      ...
      j1939_sk_netdev_event_netdown -> j1939_socks_lock
      j1939_netdev_notify
    
    1
      j1939_sk_errqueue -> j1939_socks_lock
      __j1939_session_cancel -> active_session_list_lock
      j1939_tp_rxtimer
    
           CPU0                    CPU1
           ----                    ----
      lock(&priv->active_session_list_lock);
                                   lock(&jsk->sk_session_queue_lock);
                                   lock(&priv->active_session_list_lock);
      lock(&priv->j1939_socks_lock);
    
    The solution implemented in this commit is to move the
    j1939_sk_errqueue() call out of the active_session_list_lock context,
    thus preventing the deadlock situation.
    
    Reported-by: syzbot+ee1cd780f69483a8616b@syzkaller.appspotmail.com
    Fixes: 5b9272e9 ("can: j1939: extend UAPI to notify about RX status")
    Co-developed-by: default avatarHillf Danton <hdanton@sina.com>
    Signed-off-by: default avatarHillf Danton <hdanton@sina.com>
    Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
    Link: https://lore.kernel.org/all/20230324130141.2132787-1-o.rempel@pengutronix.de
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
    d1366b28
transport.c 54.5 KB