| Message ID | 1568861888-34045-2-git-send-email-nixiaoming@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kernel/notifier.c: intercepting duplicate registrations to avoid infinite loops | expand |
On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote: > Registering the same notifier to a hook repeatedly can cause the hook > list to form a ring or lose other members of the list. > > case1: An infinite loop in notifier_chain_register() can cause soft lockup > atomic_notifier_chain_register(&test_notifier_list, &test1); > atomic_notifier_chain_register(&test_notifier_list, &test1); > atomic_notifier_chain_register(&test_notifier_list, &test2); > > case2: An infinite loop in notifier_chain_register() can cause soft lockup > atomic_notifier_chain_register(&test_notifier_list, &test1); > atomic_notifier_chain_register(&test_notifier_list, &test1); > atomic_notifier_call_chain(&test_notifier_list, 0, NULL); > > case3: lose other hook test2 > atomic_notifier_chain_register(&test_notifier_list, &test1); > atomic_notifier_chain_register(&test_notifier_list, &test2); > atomic_notifier_chain_register(&test_notifier_list, &test1); > > case4: Unregister returns 0, but the hook is still in the linked list, > and it is not really registered. If you call notifier_call_chain > after ko is unloaded, it will trigger oops. > > If the system is configured with softlockup_panic and the same > hook is repeatedly registered on the panic_notifier_list, it > will cause a loop panic. > > Add a check in notifier_chain_register(), > Intercepting duplicate registrations to avoid infinite loops > > Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com> > Reviewed-by: Vasily Averin <vvs@virtuozzo.com> > --- > kernel/notifier.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) <formletter> This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly. </formletter> Same thing goes for all of the patches in this series. thanks, greg k-h
On 2019/9/19 14:36, Greg KH wrote: > On Thu, Sep 19, 2019 at 10:58:06AM +0800, Xiaoming Ni wrote: >> Registering the same notifier to a hook repeatedly can cause the hook >> list to form a ring or lose other members of the list. >> >> case1: An infinite loop in notifier_chain_register() can cause soft lockup >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> atomic_notifier_chain_register(&test_notifier_list, &test2); >> >> case2: An infinite loop in notifier_chain_register() can cause soft lockup >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> atomic_notifier_call_chain(&test_notifier_list, 0, NULL); >> >> case3: lose other hook test2 >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> atomic_notifier_chain_register(&test_notifier_list, &test2); >> atomic_notifier_chain_register(&test_notifier_list, &test1); >> >> case4: Unregister returns 0, but the hook is still in the linked list, >> and it is not really registered. If you call notifier_call_chain >> after ko is unloaded, it will trigger oops. >> >> If the system is configured with softlockup_panic and the same >> hook is repeatedly registered on the panic_notifier_list, it >> will cause a loop panic. >> >> Add a check in notifier_chain_register(), >> Intercepting duplicate registrations to avoid infinite loops >> >> Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com> >> Reviewed-by: Vasily Averin <vvs@virtuozzo.com> >> --- >> kernel/notifier.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) > > <formletter> > > This is not the correct way to submit patches for inclusion in the > stable kernel tree. Please read: > https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html > for how to do this properly. > thanks for your guidance I thought that as long as the code exists in the stable branch, it should be copied to stable@kernel.org it is my mistake, These patches are intended to be sent to the main line. Should I resend it again? > </formletter> > > Same thing goes for all of the patches in this series. > > thanks, > > greg k-h > > . > thanks Xiaoming Ni
diff --git a/kernel/notifier.c b/kernel/notifier.c index d9f5081..30bedb8 100644 --- a/kernel/notifier.c +++ b/kernel/notifier.c @@ -23,7 +23,10 @@ static int notifier_chain_register(struct notifier_block **nl, struct notifier_block *n) { while ((*nl) != NULL) { - WARN_ONCE(((*nl) == n), "double register detected"); + if (unlikely((*nl) == n)) { + WARN(1, "double register detected"); + return 0; + } if (n->priority > (*nl)->priority) break; nl = &((*nl)->next);
Registering the same notifier to a hook repeatedly can cause the hook list to form a ring or lose other members of the list. case1: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); case2: An infinite loop in notifier_chain_register() can cause soft lockup atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_call_chain(&test_notifier_list, 0, NULL); case3: lose other hook test2 atomic_notifier_chain_register(&test_notifier_list, &test1); atomic_notifier_chain_register(&test_notifier_list, &test2); atomic_notifier_chain_register(&test_notifier_list, &test1); case4: Unregister returns 0, but the hook is still in the linked list, and it is not really registered. If you call notifier_call_chain after ko is unloaded, it will trigger oops. If the system is configured with softlockup_panic and the same hook is repeatedly registered on the panic_notifier_list, it will cause a loop panic. Add a check in notifier_chain_register(), Intercepting duplicate registrations to avoid infinite loops Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com> Reviewed-by: Vasily Averin <vvs@virtuozzo.com> --- kernel/notifier.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)