From patchwork Fri May 25 17:41:02 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xin Long X-Patchwork-Id: 920698 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="iPW/B+kH"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40stpM5VSWz9s08 for ; Sat, 26 May 2018 03:41:15 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S967408AbeEYRlM (ORCPT ); Fri, 25 May 2018 13:41:12 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:33217 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S967349AbeEYRlL (ORCPT ); Fri, 25 May 2018 13:41:11 -0400 Received: by mail-pl0-f67.google.com with SMTP id n10-v6so3549490plp.0; Fri, 25 May 2018 10:41:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=oKhTxxKyJXg+jqWe5ML8VFdublbfIE5ZraJ3I3/Rb/8=; b=iPW/B+kHoNe9zjcV/Lad9M6pM60/+mleDkRWac7+MAwcs6XYX0soDeGQasfZ8MoYlh mqsmhk4+x9WI4RLfMNjO3lWkjjQrwG4o/IRNh2lv44Rs+5pacHzjB3wJeLwMXN1IRG5X N9NAD+aSqOIqsK07IMSS4OasuMX/swVBTINNcID3tTnSDGoO9ihbs0JX3bF5smwLAAZG O5/m4O9bXPRocW65mkidn08WjmmbGFDJkTQmHPM0G7rbkDxpdJo4qOj6FD8ScMy5bPhK wJnZElei3DIiQSHeG5/9dVWFWNC/l+ogNzEXYEy0yNCQ+FXuKiJesLBPneB0Y/FHIDsK N22Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=oKhTxxKyJXg+jqWe5ML8VFdublbfIE5ZraJ3I3/Rb/8=; b=CEbO4tUTiYZqEZoo7LVtPl8r4p9Drg9OJIXSzzjpgIc1xPkJJ/Pa5bGeH7Yn9A6Hg+ egxjpfjjBFxB3IKnOwJxsbgU1UY4f+wwoXaw2Twmm8pZaz0iGxvdO/hypZmq2lF0sw9k s9w5K19dcex6gCFiD6AQhrKrX3eggBi3FfDSIUB71+HChqxijHeDMqtjUOYE+KW3BKil qv2JJmvNRodAY6ib/QKSNCuQgcLo4cMGnF6W8xU214xEhJDNEnwnG0broIyjwIDIu17v igMfov3JLzM0ZB9H/Yc1ufHz4YT+fQ/gKsf/bBmacHGWteyikB2ntRH0hA1rxFMrZB16 8MWA== X-Gm-Message-State: ALKqPwfFEcz1Xnqi7TXPjc7sEYpuBRX3+U76rdt4jjARTObhzVut7QVy N6MEpo+HEEXGNl0pgzOBGdyrHBnq X-Google-Smtp-Source: AB8JxZqMbqLQVThEGqZSP8lGFItEbfkaVJmiX/8CdEnyas/HImGz56MUnuuU57DwdSrzE9JmJ33M2A== X-Received: by 2002:a17:902:1c7:: with SMTP id b65-v6mr3542591plb.298.1527270070424; Fri, 25 May 2018 10:41:10 -0700 (PDT) Received: from localhost ([209.132.188.80]) by smtp.gmail.com with ESMTPSA id m5-v6sm5140079pfa.93.2018.05.25.10.41.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 25 May 2018 10:41:09 -0700 (PDT) From: Xin Long To: network dev , linux-sctp@vger.kernel.org Cc: davem@davemloft.net, David Ahern , Eric Dumazet , Marcelo Ricardo Leitner , Neil Horman , syzkaller@googlegroups.com Subject: [PATCH net] sctp: not allow to set rto_min with a value below 200 msecs Date: Sat, 26 May 2018 01:41:02 +0800 Message-Id: X-Mailer: git-send-email 2.1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org syzbot reported a rcu_sched self-detected stall on CPU which is caused by too small value set on rto_min with SCTP_RTOINFO sockopt. With this value, hb_timer will get stuck there, as in its timer handler it starts this timer again with this value, then goes to the timer handler again. This problem is there since very beginning, and thanks to Eric for the reproducer shared from a syzbot mail. This patch fixes it by not allowing to set rto_min with a value below 200 msecs, which is based on TCP's, by either setsockopt or sysctl. Reported-by: syzbot+3dcd59a1f907245f891f@syzkaller.appspotmail.com Suggested-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Acked-by: Neil Horman --- include/net/sctp/constants.h | 1 + net/sctp/socket.c | 10 +++++++--- net/sctp/sysctl.c | 3 ++- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h index 20ff237..2ee7a7b 100644 --- a/include/net/sctp/constants.h +++ b/include/net/sctp/constants.h @@ -277,6 +277,7 @@ enum { SCTP_MAX_GABS = 16 }; #define SCTP_RTO_INITIAL (3 * 1000) #define SCTP_RTO_MIN (1 * 1000) #define SCTP_RTO_MAX (60 * 1000) +#define SCTP_RTO_HARD_MIN 200 #define SCTP_RTO_ALPHA 3 /* 1/8 when converted to right shifts. */ #define SCTP_RTO_BETA 2 /* 1/4 when converted to right shifts. */ diff --git a/net/sctp/socket.c b/net/sctp/socket.c index ae7e7c6..6ef12c7 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -3029,7 +3029,8 @@ static int sctp_setsockopt_nodelay(struct sock *sk, char __user *optval, * be changed. * */ -static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigned int optlen) +static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, + unsigned int optlen) { struct sctp_rtoinfo rtoinfo; struct sctp_association *asoc; @@ -3056,10 +3057,13 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne else rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max; - if (rto_min) + if (rto_min) { + if (rto_min < SCTP_RTO_HARD_MIN) + return -EINVAL; rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min; - else + } else { rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min; + } if (rto_min > rto_max) return -EINVAL; diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c index 33ca5b7..7ec854a 100644 --- a/net/sctp/sysctl.c +++ b/net/sctp/sysctl.c @@ -52,6 +52,7 @@ static int rto_alpha_min = 0; static int rto_beta_min = 0; static int rto_alpha_max = 1000; static int rto_beta_max = 1000; +static int rto_hard_min = SCTP_RTO_HARD_MIN; static unsigned long max_autoclose_min = 0; static unsigned long max_autoclose_max = @@ -116,7 +117,7 @@ static struct ctl_table sctp_net_table[] = { .maxlen = sizeof(unsigned int), .mode = 0644, .proc_handler = proc_sctp_do_rto_min, - .extra1 = &one, + .extra1 = &rto_hard_min, .extra2 = &init_net.sctp.rto_max }, {