Paolo Abeni dacb5d8875 tcp: fix page frag corruption on page fault ... Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant file. The root cause is quite similar to the one addressed by commit 20eb4f29b6 ("net: fix sk_page_frag() recursion from memory reclaim"). Here the nested access to the task page frag is caused by a page fault on the (mmapped) user-space memory buffer coming from the cifs file. The page fault handler performs an smb transaction on a different socket, inside the same process context. Since sk->sk_allaction for such socket does not prevent the usage for the task_frag, the nested allocation modify "under the hood" the page frag in use by the outer sendmsg call, corrupting the stream. The overall relevant stack trace looks like the following: httpd 78268 [001] 3461630.850950: probe:tcp_sendmsg_locked: ffffffff91461d91 tcp_sendmsg_locked+0x1 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139814e sock_sendmsg+0x3e ffffffffc06dfe1d smb_send_kvec+0x28 [...] ffffffffc06cfaf8 cifs_readpages+0x213 ffffffff90e83c4b read_pages+0x6b ffffffff90e83f31 __do_page_cache_readahead+0x1c1 ffffffff90e79e98 filemap_fault+0x788 ffffffff90eb0458 __do_fault+0x38 ffffffff90eb5280 do_fault+0x1a0 ffffffff90eb7c84 __handle_mm_fault+0x4d4 ffffffff90eb8093 handle_mm_fault+0xc3 ffffffff90c74f6d __do_page_fault+0x1ed ffffffff90c75277 do_page_fault+0x37 ffffffff9160111e page_fault+0x1e ffffffff9109e7b5 copyin+0x25 ffffffff9109eb40 _copy_from_iter_full+0xe0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462370 tcp_sendmsg_locked+0x5e0 ffffffff91462b57 tcp_sendmsg+0x27 ffffffff9139815c sock_sendmsg+0x4c ffffffff913981f7 sock_write_iter+0x97 ffffffff90f2cc56 do_iter_readv_writev+0x156 ffffffff90f2dff0 do_iter_write+0x80 ffffffff90f2e1c3 vfs_writev+0xa3 ffffffff90f2e27c do_writev+0x5c ffffffff90c042bb do_syscall_64+0x5b ffffffff916000ad entry_SYSCALL_64_after_hwframe+0x65 The cifs filesystem rightfully sets sk_allocations to GFP_NOFS, we can avoid the nesting using the sk page frag for allocation lacking the __GFP_FS flag. Do not define an additional mm-helper for that, as this is strictly tied to the sk page frag usage. v1 -> v2: - use a stricted sk_page_frag() check instead of reordering the code (Eric) Reported-by: Steffen Froemer <sfroemer@redhat.com> Fixes: 5640f76858 ("net: use a per task frag allocator") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-11-29 12:13:51 +00:00
..
acpi	Merge branches 'acpica', 'acpi-ec', 'acpi-pmic' and 'acpi-video'	2021-11-10 14:03:14 +01:00
asm-generic	Add linux/cacheflush.h	2021-11-17 10:36:15 -05:00
clocksource
crypto
drm	Removed the TTM Huge Page functionnality to address a crash, a timeout	2021-11-11 08:14:19 +10:00
dt-bindings	dt-bindings: Rename Ingenic CGU headers to ingenic,*.h	2021-11-11 22:27:14 -06:00
keys
kunit	include/kunit/test.h: replace kernel.h with the necessary inclusions	2021-11-09 10:02:49 -08:00
kvm
linux	Networking fixes for 5.16-rc3, including fixes from netfilter.	2021-11-26 12:58:53 -08:00
math-emu
media	Merge branch 'akpm' (patches from Andrew)	2021-11-09 10:11:53 -08:00
memory
misc
net	tcp: fix page frag corruption on page fault	2021-11-29 12:13:51 +00:00
pcmcia
ras
rdma	RDMA/netlink: Add __maybe_unused to static inline in C file	2021-11-16 13:13:08 -04:00
scsi	SCSI misc on 20211112	2021-11-12 12:25:50 -08:00
soc	net: mscc: ocelot: create a function that replaces an existing VCAP filter	2021-11-26 11:38:20 -08:00
sound	Revert "ALSA: memalloc: Convert x86 SG-buffer handling with non-contiguous type"	2021-11-04 22:10:03 +01:00
target
trace	f2fs-for-5.16-rc1	2021-11-13 11:20:22 -08:00
uapi	virtio-mem: support VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE	2021-11-13 13:14:05 -08:00
vdso
video
xen	xen: add "not_essential" flag to struct xenbus_driver	2021-11-23 13:41:29 -06:00