net: dont call jump_label_dec from irq context

Eric Dumazet · davem330 · commit b90e5794c5bd · 2011-11-29T00:26:25.000-05:00
Igor Maravic reported an error caused by jump_label_dec() being called
from IRQ context :

 BUG: sleeping function called from invalid context at kernel/mutex.c:271
 in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
 1 lock held by swapper/0:
  #0:  (&amp;n-&gt;timer){+.-...}, at: [&lt;ffffffff8107ce90&gt;] call_timer_fn+0x0/0x340
 Pid: 0, comm: swapper Not tainted 3.2.0-rc2-net-next-mpls+ #1
Call Trace:
 &lt;IRQ&gt;  [&lt;ffffffff8104f417&gt;] __might_sleep+0x137/0x1f0
 [&lt;ffffffff816b9a2f&gt;] mutex_lock_nested+0x2f/0x370
 [&lt;ffffffff810a89fd&gt;] ? trace_hardirqs_off+0xd/0x10
 [&lt;ffffffff8109a37f&gt;] ? local_clock+0x6f/0x80
 [&lt;ffffffff810a90a5&gt;] ? lock_release_holdtime.part.22+0x15/0x1a0
 [&lt;ffffffff81557929&gt;] ? sock_def_write_space+0x59/0x160
 [&lt;ffffffff815e936e&gt;] ? arp_error_report+0x3e/0x90
 [&lt;ffffffff810969cd&gt;] atomic_dec_and_mutex_lock+0x5d/0x80
 [&lt;ffffffff8112fc1d&gt;] jump_label_dec+0x1d/0x50
 [&lt;ffffffff81566525&gt;] net_disable_timestamp+0x15/0x20
 [&lt;ffffffff81557a75&gt;] sock_disable_timestamp+0x45/0x50
 [&lt;ffffffff81557b00&gt;] __sk_free+0x80/0x200
 [&lt;ffffffff815578d0&gt;] ? sk_send_sigurg+0x70/0x70
 [&lt;ffffffff815e936e&gt;] ? arp_error_report+0x3e/0x90
 [&lt;ffffffff81557cba&gt;] sock_wfree+0x3a/0x70
 [&lt;ffffffff8155c2b0&gt;] skb_release_head_state+0x70/0x120
 [&lt;ffffffff8155c0b6&gt;] __kfree_skb+0x16/0x30
 [&lt;ffffffff8155c119&gt;] kfree_skb+0x49/0x170
 [&lt;ffffffff815e936e&gt;] arp_error_report+0x3e/0x90
 [&lt;ffffffff81575bd9&gt;] neigh_invalidate+0x89/0xc0
 [&lt;ffffffff81578dbe&gt;] neigh_timer_handler+0x9e/0x2a0
 [&lt;ffffffff81578d20&gt;] ? neigh_update+0x640/0x640
 [&lt;ffffffff81073558&gt;] __do_softirq+0xc8/0x3a0

Since jump_label_{inc|dec} must be called from process context only,
we must defer jump_label_dec() if net_disable_timestamp() is called
from interrupt context.

Reported-by: Igor Maravic &lt;igorm@etf.rs&gt;
Signed-off-by: Eric Dumazet &lt;eric.dumazet@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -1441,15 +1441,38 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 EXPORT_SYMBOL(call_netdevice_notifiers);
 
 static struct jump_label_key netstamp_needed __read_mostly;
+#ifdef HAVE_JUMP_LABEL
+/* We are not allowed to call jump_label_dec() from irq context
+ * If net_disable_timestamp() is called from irq context, defer the
+ * jump_label_dec() calls.
+ */
+static atomic_t netstamp_needed_deferred;
+#endif
 
 void net_enable_timestamp(void)
 {
+#ifdef HAVE_JUMP_LABEL
+	int deferred = atomic_xchg(&netstamp_needed_deferred, 0);
+
+	if (deferred) {
+		while (--deferred)
+			jump_label_dec(&netstamp_needed);
+		return;
+	}
+#endif
+	WARN_ON(in_interrupt());
 	jump_label_inc(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_enable_timestamp);
 
 void net_disable_timestamp(void)
 {
+#ifdef HAVE_JUMP_LABEL
+	if (in_interrupt()) {
+		atomic_inc(&netstamp_needed_deferred);
+		return;
+	}
+#endif
 	jump_label_dec(&netstamp_needed);
 }
 EXPORT_SYMBOL(net_disable_timestamp);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
@@ -404,6 +404,7 @@ __ipq_rcv_skb(struct sk_buff *skb)
 	int status, type, pid, flags;
 	unsigned int nlmsglen, skblen;
 	struct nlmsghdr *nlh;
+	bool enable_timestamp = false;
 
 	skblen = skb->len;
 	if (skblen < sizeof(*nlh))
@@ -441,12 +442,13 @@ __ipq_rcv_skb(struct sk_buff *skb)
 			RCV_SKB_FAIL(-EBUSY);
 		}
 	} else {
-		net_enable_timestamp();
+		enable_timestamp = true;
 		peer_pid = pid;
 	}
 
 	spin_unlock_bh(&queue_lock);
-
+	if (enable_timestamp)
+		net_enable_timestamp();
 	status = ipq_receive_peer(NLMSG_DATA(nlh), type,
 				  nlmsglen - NLMSG_LENGTH(0));
 	if (status < 0)
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
@@ -405,6 +405,7 @@ __ipq_rcv_skb(struct sk_buff *skb)
 	int status, type, pid, flags;
 	unsigned int nlmsglen, skblen;
 	struct nlmsghdr *nlh;
+	bool enable_timestamp = false;
 
 	skblen = skb->len;
 	if (skblen < sizeof(*nlh))
@@ -442,11 +443,13 @@ __ipq_rcv_skb(struct sk_buff *skb)
 			RCV_SKB_FAIL(-EBUSY);
 		}
 	} else {
-		net_enable_timestamp();
+		enable_timestamp = true;
 		peer_pid = pid;
 	}
 
 	spin_unlock_bh(&queue_lock);
+	if (enable_timestamp)
+		net_enable_timestamp();
 
 	status = ipq_receive_peer(NLMSG_DATA(nlh), type,
 				  nlmsglen - NLMSG_LENGTH(0));
