Skip to content

Commit 7e27e8d

Browse files
Junwei Hudavem330
authored andcommitted
tipc: switch order of device registration to fix a crash
When tipc is loaded while many processes try to create a TIPC socket, a crash occurs: PANIC: Unable to handle kernel paging request at virtual address "dfff20000000021d" pc : tipc_sk_create+0x374/0x1180 [tipc] lr : tipc_sk_create+0x374/0x1180 [tipc] Exception class = DABT (current EL), IL = 32 bits Call trace: tipc_sk_create+0x374/0x1180 [tipc] __sock_create+0x1cc/0x408 __sys_socket+0xec/0x1f0 __arm64_sys_socket+0x74/0xa8 ... This is due to race between sock_create and unfinished register_pernet_device. tipc_sk_insert tries to do "net_generic(net, tipc_net_id)". but tipc_net_id is not initialized yet. So switch the order of the two to close the race. This can be reproduced with multiple processes doing socket(AF_TIPC, ...) and one process doing module removal. Fixes: a62fbcc ("tipc: make subscriber server support net namespace") Signed-off-by: Junwei Hu <hujunwei4@huawei.com> Reported-by: Wang Wang <wangwang2@huawei.com> Reviewed-by: Xiaogang Wang <wangxiaogang3@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 61fb0d0 commit 7e27e8d

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

net/tipc/core.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -131,10 +131,6 @@ static int __init tipc_init(void)
131131
if (err)
132132
goto out_netlink_compat;
133133

134-
err = tipc_socket_init();
135-
if (err)
136-
goto out_socket;
137-
138134
err = tipc_register_sysctl();
139135
if (err)
140136
goto out_sysctl;
@@ -143,19 +139,23 @@ static int __init tipc_init(void)
143139
if (err)
144140
goto out_pernet;
145141

142+
err = tipc_socket_init();
143+
if (err)
144+
goto out_socket;
145+
146146
err = tipc_bearer_setup();
147147
if (err)
148148
goto out_bearer;
149149

150150
pr_info("Started in single node mode\n");
151151
return 0;
152152
out_bearer:
153+
tipc_socket_stop();
154+
out_socket:
153155
unregister_pernet_subsys(&tipc_net_ops);
154156
out_pernet:
155157
tipc_unregister_sysctl();
156158
out_sysctl:
157-
tipc_socket_stop();
158-
out_socket:
159159
tipc_netlink_compat_stop();
160160
out_netlink_compat:
161161
tipc_netlink_stop();
@@ -167,10 +167,10 @@ static int __init tipc_init(void)
167167
static void __exit tipc_exit(void)
168168
{
169169
tipc_bearer_cleanup();
170+
tipc_socket_stop();
170171
unregister_pernet_subsys(&tipc_net_ops);
171172
tipc_netlink_stop();
172173
tipc_netlink_compat_stop();
173-
tipc_socket_stop();
174174
tipc_unregister_sysctl();
175175

176176
pr_info("Deactivated\n");

0 commit comments

Comments
 (0)