Skip to content
  • David Howells's avatar
    RxRPC: Fix a potential deadlock between the call resend_timer and state_lock · 3b5bac2b
    David Howells authored
    RxRPC can potentially deadlock as rxrpc_resend_time_expired() wants to get
    call->state_lock so that it can alter the state of an RxRPC call.  However, its
    caller (call_timer_fn()) has an apparent lock on the timer struct.
    
    The problem is that rxrpc_resend_time_expired() isn't permitted to lock
    call->state_lock as this could cause a deadlock against rxrpc_send_abort() as
    that takes state_lock and then attempts to delete the resend timer by calling
    del_timer_sync().
    
    The deadlock can occur because del_timer_sync() will sit there forever waiting
    for rxrpc_resend_time_expired() to return, but the latter may then wait for
    call->state_lock, which rxrpc_send_abort() holds around del_timer_sync()...
    
    This leads to a warning appearing in the kernel log that looks something like
    the attached.
    
    It should be sufficient to simply dispense with the locks.  It doesn't matter
    if we set the resend timer expired event bit and queue the event proce...
    3b5bac2b