Skip to content
Commit f1acf1ac authored by Allison Henderson's avatar Allison Henderson Committed by Paolo Abeni
Browse files

net:rds: Fix possible deadlock in rds_message_put

Functions rds_still_queued and rds_clear_recv_queue lock a given socket
in order to safely iterate over the incoming rds messages. However
calling rds_inc_put while under this lock creates a potential deadlock.
rds_inc_put may eventually call rds_message_purge, which will lock
m_rs_lock. This is the incorrect locking order since m_rs_lock is
meant to be locked before the socket. To fix this, we move the message
item to a local list or variable that wont need rs_recv_lock protection.
Then we can safely call rds_inc_put on any item stored locally after
rs_recv_lock is released.

Fixes: bdbe6fbc

 ("RDS: recv.c")
Reported-by: default avatar <syzbot+f9db6ff27b9bfdcfeca0@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+dcd73ff9291e6d34b3ab@syzkaller.appspotmail.com>
Signed-off-by: default avatarAllison Henderson <allison.henderson@oracle.com>
Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@oracle.com
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 9f308313
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment