Joseph Huang 851d0a73c9 bridge: Fix a deadlock when enabling multicast snooping ... When enabling multicast snooping, bridge module deadlocks on multicast_lock if 1) IPv6 is enabled, and 2) there is an existing querier on the same L2 network. The deadlock was caused by the following sequence: While holding the lock, br_multicast_open calls br_multicast_join_snoopers, which eventually causes IP stack to (attempt to) send out a Listener Report (in igmp6_join_group). Since the destination Ethernet address is a multicast address, br_dev_xmit feeds the packet back to the bridge via br_multicast_rcv, which in turn calls br_multicast_add_group, which then deadlocks on multicast_lock. The fix is to move the call br_multicast_join_snoopers outside of the critical section. This works since br_multicast_join_snoopers only deals with IP and does not modify any multicast data structures of the bridge, so there's no need to hold the lock. Steps to reproduce: 1. sysctl net.ipv6.conf.all.force_mld_version=1 2. have another querier 3. ip link set dev bridge type bridge mcast_snooping 0 && \ ip link set dev bridge type bridge mcast_snooping 1 < deadlock > A typical call trace looks like the following: [ 936.251495] _raw_spin_lock+0x5c/0x68 [ 936.255221] br_multicast_add_group+0x40/0x170 [bridge] [ 936.260491] br_multicast_rcv+0x7ac/0xe30 [bridge] [ 936.265322] br_dev_xmit+0x140/0x368 [bridge] [ 936.269689] dev_hard_start_xmit+0x94/0x158 [ 936.273876] __dev_queue_xmit+0x5ac/0x7f8 [ 936.277890] dev_queue_xmit+0x10/0x18 [ 936.281563] neigh_resolve_output+0xec/0x198 [ 936.285845] ip6_finish_output2+0x240/0x710 [ 936.290039] __ip6_finish_output+0x130/0x170 [ 936.294318] ip6_output+0x6c/0x1c8 [ 936.297731] NF_HOOK.constprop.0+0xd8/0xe8 [ 936.301834] igmp6_send+0x358/0x558 [ 936.305326] igmp6_join_group.part.0+0x30/0xf0 [ 936.309774] igmp6_group_added+0xfc/0x110 [ 936.313787] __ipv6_dev_mc_inc+0x1a4/0x290 [ 936.317885] ipv6_dev_mc_inc+0x10/0x18 [ 936.321677] br_multicast_open+0xbc/0x110 [bridge] [ 936.326506] br_multicast_toggle+0xec/0x140 [bridge] Fixes: 4effd28c12 ("bridge: join all-snoopers multicast address") Signed-off-by: Joseph Huang <Joseph.Huang@garmin.com> Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com> Link: https://lore.kernel.org/r/20201204235628.50653-1-Joseph.Huang@garmin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2020-12-07 17:14:43 -08:00
..
netfilter	netfilter: ebtables: Fixes dropping of small packets in bridge nat	2020-10-20 13:54:53 +02:00
br_arp_nd_proxy.c	net: core: introduce struct netdev_nested_priv for nested interface infrastructure	2020-09-28 15:00:15 -07:00
br_device.c	bridge: Fix a deadlock when enabling multicast snooping	2020-12-07 17:14:43 -08:00
br_fdb.c	net: bridge: fdb: don't flush ext_learn entries	2020-09-28 12:47:43 -07:00
br_forward.c	net: bridge: mcast: when forwarding handle filter mode and blocked flag	2020-09-23 13:24:35 -07:00
br_if.c
br_input.c
br_ioctl.c	net: bridge: delete duplicated words	2020-09-18 14:12:43 -07:00
br_mdb.c	net: bridge: mcast: add support for blocked port groups	2020-09-23 13:24:34 -07:00
br_mrp_netlink.c
br_mrp_switchdev.c
br_mrp.c
br_multicast.c	bridge: Fix a deadlock when enabling multicast snooping	2020-12-07 17:14:43 -08:00
br_netfilter_hooks.c	netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal	2020-11-28 11:46:51 -08:00
br_netfilter_ipv6.c
br_netlink_tunnel.c
br_netlink.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-08 15:44:50 -07:00
br_nf_core.c
br_private_mrp.h
br_private_stp.h
br_private_tunnel.h
br_private.h	bridge: Fix a deadlock when enabling multicast snooping	2020-12-07 17:14:43 -08:00
br_stp_bpdu.c
br_stp_if.c
br_stp_timer.c
br_stp.c
br_switchdev.c
br_sysfs_br.c
br_sysfs_if.c
br_vlan_options.c
br_vlan_tunnel.c
br_vlan.c	net: bridge: vlan: fix error return code in __vlan_add()	2020-12-04 15:41:06 -08:00
br.c	bridge: Add SWITCHDEV_FDB_FLUSH_TO_BRIDGE notifier	2020-09-15 13:21:47 -07:00
Kconfig
Makefile