Commit d4014d8c authored Feb 13, 2018 by Sowmini Varadhan Committed by David S. Miller Feb 13, 2018

rds: do not call ->conn_alloc with GFP_KERNEL



Commit ebeeb1ad ("rds: tcp: use rds_destroy_pending() to synchronize
netns/module teardown and rds connection/workq management")
adds an rcu read critical section to __rd_conn_create. The
memory allocations in that critcal section need to use
GFP_ATOMIC to avoid sleeping.

This patch was verified with syzkaller reproducer.

Reported-by:  <syzbot+a0564419941aaae3fe3c@syzkaller.appspotmail.com>
Fixes: ebeeb1ad ("rds: tcp: use rds_destroy_pending() to synchronize
       netns/module teardown and rds connection/workq management")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f7219bf3

net/rds/connection.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -224,7 +224,7 @@ static struct rds_connection __rds_conn_create(struct net net,
		if (rds_destroy_pending(conn))
		ret = -ENETDOWN;
		else
		ret = trans->conn_alloc(conn, gfp);
		ret = trans->conn_alloc(conn, GFP_ATOMIC);
		if (ret) {
		rcu_read_unlock();
		kfree(conn->c_path);

Admin message