Commit 9e4e48d5 authored by Wen Gu's avatar Wen Gu Committed by Wang Liang
Browse files

net/smc: initialize close_work early to avoid warning 

stable inclusion
from stable-v6.6.66
commit f0c37002210aaede10dae849d1a78efc2243add2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPB
CVE: CVE-2024-56641

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f0c37002210aaede10dae849d1a78efc2243add2



--------------------------------

[ Upstream commit 0541db8ee32c09463a72d0987382b3a3336b0043 ]

We encountered a warning that close_work was canceled before
initialization.

  WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0
  Workqueue: events smc_lgr_terminate_work [smc]
  RIP: 0010:__flush_work+0x19e/0x1b0
  Call Trace:
   ? __wake_up_common+0x7a/0x190
   ? work_busy+0x80/0x80
   __cancel_work_timer+0xe3/0x160
   smc_close_cancel_work+0x1a/0x70 [smc]
   smc_close_active_abort+0x207/0x360 [smc]
   __smc_lgr_terminate.part.38+0xc8/0x180 [smc]
   process_one_work+0x19e/0x340
   worker_thread+0x30/0x370
   ? process_one_work+0x340/0x340
   kthread+0x117/0x130
   ? __kthread_cancel_work+0x50/0x50
   ret_from_fork+0x22/0x30

This is because when smc_close_cancel_work is triggered, e.g. the RDMA
driver is rmmod and the LGR is terminated, the conn->close_work is
flushed before initialization, resulting in WARN_ON(!work->func).

__smc_lgr_terminate             | smc_connect_{rdma|ism}
-------------------------------------------------------------
                                | smc_conn_create
				| \- smc_lgr_register_conn
for conn in lgr->conns_all      |
\- smc_conn_kill                |
   \- smc_close_active_abort    |
      \- smc_close_cancel_work  |
         \- cancel_work_sync    |
            \- __flush_work     |
	         (close_work)   |
	                        | smc_close_init
	                        | \- INIT_WORK(&close_work)

So fix this by initializing close_work before establishing the
connection.

Fixes: 46c28dbd ("net/smc: no socket state changes in tasklet context")
Fixes: 41349844 ("net/smc: add SMC-D support in af_smc")
Signed-off-by: default avatarWen Gu <guwen@linux.alibaba.com>
Reviewed-by: default avatarWenjia Zhang <wenjia@linux.ibm.com>
Reviewed-by: default avatarAlexandra Winter <wintera@linux.ibm.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Liang <wangliang74@huawei.com>
parent 8beeebe9

net/smc/af_smc.c

+1 −3
Original line number Diff line number Diff line
@@ -384,6 +384,7 @@ void smc_sk_init(struct net *net, struct sock *sk, int protocol) 
	smc->limit_smc_hs = net->smc.limit_smc_hs;

	smc->use_fallback = false; /* assume rdma capability first */

	smc->fallback_rsn = 0;

	smc_close_init(smc);

}



static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
@@ -1299,7 +1300,6 @@ static int smc_connect_rdma(struct smc_sock *smc, 
		goto connect_abort;

	}



	smc_close_init(smc);

	smc_rx_init(smc);



	if (ini->first_contact_local) {
@@ -1435,7 +1435,6 @@ static int smc_connect_ism(struct smc_sock *smc, 
			goto connect_abort;

		}

	}

	smc_close_init(smc);

	smc_rx_init(smc);

	smc_tx_init(smc);
@@ -2487,7 +2486,6 @@ static void smc_listen_work(struct work_struct *work) 
		goto out_decl;



	mutex_lock(&smc_server_lgr_pending);

	smc_close_init(new_smc);

	smc_rx_init(new_smc);

	smc_tx_init(new_smc);