Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]tty: n_gsm: fix deadlock and link starvation in outgoing data path[EOL][EOL]The current implementation queues up new control and user packets as needed[EOL]and processes this queue down to the ldisc in the same code path.[EOL]That means that the upper and the lower layer are hard coupled in the code.[EOL]Due to this deadlocks can happen as seen below while transmitting data,[EOL]especially during ldisc congestion. Furthermore, the data channels starve[EOL]the control channel on high transmission load on the ldisc.[EOL][EOL]Introduce an additional control channel data queue to prevent timeouts and[EOL]link hangups during ldisc congestion. This is being processed before the[EOL]user channel data queue in gsm_data_kick(), i.e. with the highest priority.[EOL]Put the queue to ldisc data path into a workqueue and trigger it whenever[EOL]new data has been put into the transmission queue. Change[EOL]gsm_dlci_data_sweep() accordingly to fill up the transmission queue until[EOL]TX_THRESH_HI. This solves the locking issue, keeps latency low and provides[EOL]good performance on high data load.[EOL]Note that now all packets from a DLCI are removed from the internal queue[EOL]if the associated DLCI was closed. This ensures that no data is sent by the[EOL]introduced write task to an already closed DLCI.[EOL][EOL]BUG: spinlock recursion on CPU#0, test_v24_loop/124[EOL] lock: serial8250_ports+0x3a8/0x7500, .magic: dead4ead, .owner: test_v24_loop/124, .owner_cpu: 0[EOL]CPU: 0 PID: 124 Comm: test_v24_loop Tainted: G           O      5.18.0-rc2 #3[EOL]Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014[EOL]Call Trace:[EOL] <IRQ>[EOL] dump_stack_lvl+0x34/0x44[EOL] do_raw_spin_lock+0x76/0xa0[EOL] _raw_spin_lock_irqsave+0x72/0x80[EOL] uart_write_room+0x3b/0xc0[EOL] gsm_data_kick+0x14b/0x240 [n_gsm][EOL] gsmld_write_wakeup+0x35/0x70 [n_gsm][EOL] tty_wakeup+0x53/0x60[EOL] tty_port_default_wakeup+0x1b/0x30[EOL] serial8250_tx_chars+0x12f/0x220[EOL] serial8250_handle_irq.part.0+0xfe/0x150[EOL] serial8250_default_handle_irq+0x48/0x80[EOL] serial8250_interrupt+0x56/0xa0[EOL] __handle_irq_event_percpu+0x78/0x1f0[EOL] handle_irq_event+0x34/0x70[EOL] handle_fasteoi_irq+0x90/0x1e0[EOL] __common_interrupt+0x69/0x100[EOL] common_interrupt+0x48/0xc0[EOL] asm_common_interrupt+0x1e/0x40[EOL]RIP: 0010:__do_softirq+0x83/0x34e[EOL]Code: 2a 0a ff 0f b7 ed c7 44 24 10 0a 00 00 00 48 c7 c7 51 2a 64 82 e8 2d[EOL]e2 d5 ff 65 66 c7 05 83 af 1e 7e 00 00 fb b8 ff ff ff ff <49> c7 c2 40 61[EOL]80 82 0f bc c5 41 89 c4 41 83 c4 01 0f 84 e6 00 00[EOL]RSP: 0018:ffffc90000003f98 EFLAGS: 00000286[EOL]RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 0000000000000000[EOL]RDX: 0000000000000000 RSI: ffffffff82642a51 RDI: ffffffff825bb5e7[EOL]RBP: 0000000000000200 R08: 00000008de3271a8 R09: 0000000000000000[EOL]R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000[EOL]R13: 0000000000000030 R14: 0000000000000000 R15: 0000000000000000[EOL] ? __do_softirq+0x73/0x34e[EOL] irq_exit_rcu+0xb5/0x100[EOL] common_interrupt+0xa4/0xc0[EOL] </IRQ>[EOL] <TASK>[EOL] asm_common_interrupt+0x1e/0x40[EOL]RIP: 0010:_raw_spin_unlock_irqrestore+0x2e/0x50[EOL]Code: 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 85 28 36 ff[EOL]48 89 ef e8 cd 58 36 ff 80 e7 02 74 01 fb bf 01 00 00 00 <e8> 3d 97 33 ff[EOL]65 8b 05 96 23 2b 7e 85 c0 74 03 5b 5d c3 0f 1f 44[EOL]RSP: 0018:ffffc9000020fd08 EFLAGS: 00000202[EOL]RAX: 0000000000000000 RBX: 0000000000000246 RCX: 0000000000000000[EOL]RDX: 0000000000000004 RSI: ffffffff8257fd74 RDI: 0000000000000001[EOL]RBP: ffff8880057de3a0 R08: 00000008de233000 R09: 0000000000000000[EOL]R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000[EOL]R13: 0000000000000100 R14: 0000000000000202 R15: ffff8880057df0b8[EOL] ? _raw_spin_unlock_irqrestore+0x23/0x50[EOL] gsmtty_write+0x65/0x80 [n_gsm][EOL] n_tty_write+0x33f/0x530[EOL] ? swake_up_all+0xe0/0xe0[EOL] file_tty_write.constprop.0+0x1b1/0x320[EOL] ? n_tty_flush_buffer+0xb0/0xb0[EOL] new_sync_write+0x10c/0x190[EOL] vfs_write+0x282/0x310[EOL] ksys_write+0x68/0xe0[EOL] do_syscall_64+0x3b/0x90[EOL] entry_SYSCALL_64_after_hwframe+0x44/0xae[EOL]RIP: 0033:0x7f3e5e35c15c[EOL]Code: 8b 7c 24 08 89 c5 e8 c5 ff ff ff 89 ef 89 44 24[EOL]---truncated---