[V2] kni: fix rtnl deadlocks and race conditions v2
Checks
Commit Message
This version 2 of the patch leverages on Stephen Hemminger's 64106
patch from Dec 2019,
and fixes the issues reported by Ferruh and Igor:
A. KNI sync lock is being locked while rtnl is held.
If two threads are calling kni_net_process_request() ,
then the first one will take the sync lock, release rtnl lock then sleep.
The second thread will try to lock sync lock while holding rtnl.
The first thread will wake, and try to lock rtnl, resulting in a deadlock.
The remedy is to release rtnl before locking the KNI sync lock.
Since in between nothing is accessing Linux network-wise,
no rtnl locking is needed.
B. There is a race condition in __dev_close_many() processing the
close_list while the application terminates.
It looks like if two vEth devices are terminating,
and one releases the rtnl lock, the other takes it,
updating the close_list in an unstable state,
causing the close_list to become a circular linked list,
hence list_for_each_entry() will endlessly loop inside
__dev_close_many() .
Since the description for the original patch indicate the
original motivation was bringing the device up,
I have changed kni_net_process_request() to hold the rtnl mutex
in case of bringing the device down since this is the path called
from __dev_close_many() , causing the corruption of the close_list.
Depends-on: patch-64106 ("kni: fix kernel deadlock when using mlx devices")
Signed-off-by: Elad Nachman <eladv6@gmail.com>
---
V2:
* rebuild the patch as increment from patch 64106
* fix comment and blank lines
---
kernel/linux/kni/kni_net.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
@@ -110,9 +110,22 @@ kni_net_process_request(struct net_device *dev, struct rte_kni_request *req)
void *resp_va;
uint32_t num;
int ret_val;
+ int req_is_dev_stop = 0;
+
+ if (req->req_id == RTE_KNI_REQ_CFG_NETWORK_IF &&
+ req->if_up == 0)
+ req_is_dev_stop = 1;
ASSERT_RTNL();
+ /* Since we need to wait and RTNL mutex is held
+ * drop the mutex and hold reference to keep device
+ */
+ if (!req_is_dev_stop) {
+ dev_hold(dev);
+ rtnl_unlock();
+ }
+
mutex_lock(&kni->sync_lock);
/* Construct data */
@@ -124,16 +137,8 @@ kni_net_process_request(struct net_device *dev, struct rte_kni_request *req)
goto fail;
}
- /* Since we need to wait and RTNL mutex is held
- * drop the mutex and hold refernce to keep device
- */
- dev_hold(dev);
- rtnl_unlock();
-
ret_val = wait_event_interruptible_timeout(kni->wq,
kni_fifo_count(kni->resp_q), 3 * HZ);
- rtnl_lock();
- dev_put(dev);
if (signal_pending(current) || ret_val <= 0) {
ret = -ETIME;
@@ -152,6 +157,10 @@ kni_net_process_request(struct net_device *dev, struct rte_kni_request *req)
fail:
mutex_unlock(&kni->sync_lock);
+ if (!req_is_dev_stop) {
+ rtnl_lock();
+ dev_put(dev);
+ }
return ret;
}