linux/net
Curt Brune fe0d692bbc bridge: use spin_lock_bh() in br_multicast_set_hash_max
br_multicast_set_hash_max() is called from process context in
net/bridge/br_sysfs_br.c by the sysfs store_hash_max() function.

br_multicast_set_hash_max() calls spin_lock(&br->multicast_lock),
which can deadlock the CPU if a softirq that also tries to take the
same lock interrupts br_multicast_set_hash_max() while the lock is
held .  This can happen quite easily when any of the bridge multicast
timers expire, which try to take the same lock.

The fix here is to use spin_lock_bh(), preventing other softirqs from
executing on this CPU.

Steps to reproduce:

1. Create a bridge with several interfaces (I used 4).
2. Set the "multicast query interval" to a low number, like 2.
3. Enable the bridge as a multicast querier.
4. Repeatedly set the bridge hash_max parameter via sysfs.

  # brctl addbr br0
  # brctl addif br0 eth1 eth2 eth3 eth4
  # brctl setmcqi br0 2
  # brctl setmcquerier br0 1

  # while true ; do echo 4096 > /sys/class/net/br0/bridge/hash_max; done

Signed-off-by: Curt Brune <curt@cumulusnetworks.com>
Signed-off-by: Scott Feldman <sfeldma@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-01-06 16:39:47 -05:00
..
9p
802
8021q vlan: Fix header ops passthru when doing TX VLAN offload. 2013-12-31 16:23:35 -05:00
appletalk
atm
ax25
batman-adv batman-adv: fix vlan header access 2013-12-28 14:48:40 +01:00
bluetooth Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth 2013-12-18 13:46:08 -05:00
bridge bridge: use spin_lock_bh() in br_multicast_set_hash_max 2014-01-06 16:39:47 -05:00
caif
can
ceph
core netpoll: Fix missing TXQ unlock and and OOPS. 2014-01-02 19:50:52 -05:00
dcb
dccp dccp: catch failed request_module call in dccp_probe init 2013-12-19 19:25:50 -05:00
decnet
dns_resolver
dsa
ethernet
hsr
ieee802154 net: 6lowpan: fix lowpan_header_create non-compression memcpy call 2014-01-05 20:25:24 -05:00
ipv4 ipv4: fix tunneled VM traffic over hw VXLAN/GRE GSO NIC 2014-01-02 19:06:47 -05:00
ipv6 ipv6: don't install anycast address for /128 addresses on routers 2014-01-06 16:32:43 -05:00
ipx
irda
iucv
key
l2tp ipv6: do not erase dst address with flow label destination 2013-12-10 22:51:00 -05:00
lapb
llc net: llc: fix use after free in llc_ui_recvmsg 2014-01-02 19:31:09 -05:00
mac80211 mac80211: check csa wiphy flag in ibss before switching 2013-12-02 11:54:13 +01:00
mac802154
mpls
netfilter netfilter: nf_tables: fix wrong datatype in nft_validate_data_load() 2013-12-28 22:32:28 +01:00
netlabel
netlink
netrom
nfc
openvswitch
packet packet: fix send path when running with proto == 0 2013-12-09 20:09:20 -05:00
phonet
rds rds: prevent dereference of a NULL device 2013-12-27 12:33:58 -05:00
rfkill
rose net: rose: restore old recvmsg behavior 2013-12-29 22:33:17 -05:00
rxrpc
sched net_sched: act: Dont increment refcnt on replace 2013-12-27 12:50:00 -05:00
sctp sctp: Remove outqueue empty state 2014-01-02 17:22:48 -05:00
sunrpc NFS client bugfixes 2013-12-05 13:05:48 -08:00
tipc tipc: fix deadlock during socket release 2013-12-29 22:24:07 -05:00
unix net: unix: allow bind to fail on mutex lock 2013-12-17 15:04:42 -05:00
vmw_vsock
wimax
wireless radiotap: fix bitmap-end-finding buffer overrun 2013-12-16 12:06:43 +01:00
x25
xfrm
compat.c
Kconfig
Makefile
nonet.c
socket.c
sysctl_net.c