Parthasarathy Bhuvaragan
458be024ef
tipc: remove subscription references only for pending timers
In commit, 139bb36f75 ("tipc: advance the time of deleting
subscription from subscriber->subscrp_list"), we delete the
subscription from the subscribers list and from nametable
unconditionally. This leads to the following bug if the timer
running tipc_subscrp_timeout() in another CPU accesses the
subscription list after the subscription delete request.
[39.570] general protection fault: 0000 [#1] SMP
::
[39.574] task: ffffffff81c10540 task.stack: ffffffff81c00000
[39.575] RIP: 0010:tipc_subscrp_timeout+0x32/0x80 [tipc]
[39.576] RSP: 0018:ffff88003ba03e90 EFLAGS: 00010282
[39.576] RAX: dead000000000200 RBX: ffff88003f0f3600 RCX: 0000000000000101
[39.577] RDX: dead000000000100 RSI: 0000000000000201 RDI: ffff88003f0d7948
[39.578] RBP: ffff88003ba03ea0 R08: 0000000000000001 R09: ffff88003ba03ef8
[39.579] R10: 000000000000014f R11: 0000000000000000 R12: ffff88003f0d7948
[39.580] R13: ffff88003f0f3618 R14: ffffffffa006c250 R15: ffff88003f0f3600
[39.581] FS: 0000000000000000(0000) GS:ffff88003ba00000(0000) knlGS:0000000000000000
[39.582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[39.583] CR2: 00007f831c6e0714 CR3: 000000003d3b0000 CR4: 00000000000006f0
[39.584] Call Trace:
[39.584] <IRQ>
[39.585] call_timer_fn+0x3d/0x180
[39.585] ? tipc_subscrb_rcv_cb+0x260/0x260 [tipc]
[39.586] run_timer_softirq+0x168/0x1f0
[39.586] ? sched_clock_cpu+0x16/0xc0
[39.587] __do_softirq+0x9b/0x2de
[39.587] irq_exit+0x60/0x70
[39.588] smp_apic_timer_interrupt+0x3d/0x50
[39.588] apic_timer_interrupt+0x86/0x90
[39.589] RIP: 0010:default_idle+0x20/0xf0
[39.589] RSP: 0018:ffffffff81c03e58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
[39.590] RAX: 0000000000000000 RBX: ffffffff81c10540 RCX: 0000000000000000
[39.591] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[39.592] RBP: ffffffff81c03e68 R08: 0000000000000000 R09: 0000000000000000
[39.593] R10: ffffc90001cbbe00 R11: 0000000000000000 R12: 0000000000000000
[39.594] R13: ffffffff81c10540 R14: 0000000000000000 R15: 0000000000000000
[39.595] </IRQ>
::
[39.603] RIP: tipc_subscrp_timeout+0x32/0x80 [tipc] RSP: ffff88003ba03e90
[39.604] ---[ end trace 79ce94b7216cb459 ]---
Fixes: 139bb36f75 ("tipc: advance the time of deleting subscription from subscriber->subscrp_list")
Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-08-22 14:25:02 -07:00
..
2017-04-12 22:02:40 +02:00
2017-07-15 12:00:42 -07:00
2017-06-20 13:30:14 -04:00
2017-06-26 23:13:22 -04:00
2017-06-16 11:48:40 -04:00
2017-07-04 22:35:16 +01:00
2017-07-04 22:35:19 +01:00
2017-07-31 11:17:38 +02:00
2017-07-05 12:31:59 -07:00
2017-05-02 11:46:28 -04:00
2017-07-14 08:19:23 -07:00
2017-07-01 07:39:08 -07:00
2017-06-16 11:48:37 -04:00
2017-08-01 16:46:45 +02:00
2017-08-18 15:12:54 -07:00
2017-05-21 13:42:33 -04:00
2017-08-16 14:26:26 -07:00
2017-07-04 22:35:15 +01:00
2017-03-03 10:16:38 -08:00
2017-08-11 13:57:08 -07:00
2017-06-16 11:48:40 -04:00
2017-08-22 13:40:23 -07:00
2017-06-26 23:13:22 -04:00
2017-08-22 10:27:26 -07:00
2017-08-22 11:03:19 -07:00
2017-07-04 22:35:17 +01:00
2017-08-18 16:21:51 -07:00
2017-07-03 02:31:22 -07:00
2017-07-01 07:39:08 -07:00
2017-08-14 22:18:12 -07:00
2017-07-04 22:35:15 +01:00
2017-07-04 22:35:16 +01:00
2017-07-04 22:35:15 +01:00
2017-08-09 09:49:42 +03:00
2017-06-07 15:53:24 -04:00
2017-07-08 11:26:41 +01:00
2017-06-16 11:48:40 -04:00
2017-07-20 16:33:39 -07:00
2017-04-13 13:58:22 -04:00
2017-07-01 07:39:08 -07:00
2017-07-04 22:35:17 +01:00
2017-06-23 00:38:31 +02:00
2017-08-16 14:12:37 -07:00
2017-08-10 09:52:12 -07:00
2017-07-01 07:39:08 -07:00
2017-06-16 11:48:39 -04:00
2017-06-16 11:48:39 -04:00
2017-08-08 21:03:47 -07:00
2017-06-13 11:07:51 +02:00
2017-03-09 18:23:27 -08:00
2017-08-18 16:23:23 -07:00
2017-08-18 16:25:49 -07:00
2017-08-18 16:00:47 -07:00
2017-05-16 14:49:43 -04:00
2017-03-03 20:43:26 -08:00
2017-07-21 16:26:01 -07:00
2017-06-08 14:16:24 -04:00
2017-08-22 14:25:02 -07:00
2017-07-06 10:58:19 +01:00
2017-08-18 15:12:54 -07:00
2017-06-20 13:30:15 -04:00
2017-07-07 11:35:55 +01:00
2017-07-04 22:35:18 +01:00
2017-08-03 10:15:22 +02:00
2017-07-04 13:14:34 -04:00
2017-06-15 12:12:40 -04:00
2017-06-15 12:12:40 -04:00
2017-07-24 14:17:01 -07:00
2017-04-16 23:42:49 -05:00