Skip to content
  • Ilya Dryomov's avatar
    libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() · 4aac9228
    Ilya Dryomov authored
    
    
    con_fault() can transition the connection into STANDBY right after
    ceph_con_keepalive() clears STANDBY in clear_standby():
    
        libceph user thread               ceph-msgr worker
    
    ceph_con_keepalive()
      mutex_lock(&con->mutex)
      clear_standby(con)
      mutex_unlock(&con->mutex)
                                    mutex_lock(&con->mutex)
                                    con_fault()
                                      ...
                                      if KEEPALIVE_PENDING isn't set
                                        set state to STANDBY
                                      ...
                                    mutex_unlock(&con->mutex)
      set KEEPALIVE_PENDING
      set WRITE_PENDING
    
    This triggers warnings in clear_standby() when either ceph_con_send()
    or ceph_con_keepalive() get to clearing STANDBY next time.
    
    I don't see a reason to condition queue_con() call on the previous
    value of KEEPALIVE_PENDING, so move the setting of KEEPALIVE_PENDING
    into the critical section -- unlike WRITE_PENDING, KEEPALIVE_PENDING
    could have been a non-atomic flag.
    
    Reported-by: default avatar <syzbot+acdeb633f6211ccdf886@syzkaller.appspotmail.com>
    Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
    Tested-by: default avatarMyungho Jung <mhjungk@gmail.com>
    4aac9228