From: Ridge Kennedy <[email protected]>
Date: Wed, 22 Feb 2017 14:59:49 +1300
> While destroying a network namespace that contains a L2TP tunnel a
> "BUG: scheduling while atomic" can be observed.
>
> Enabling lockdep shows that this is happening because l2tp_exit_net()
> is calling l2tp_tunnel_closeall() (via l2tp_tunnel_delete()) from
> within an RCU critical section.
...
> This bug can easily be reproduced with a few steps:
>
> $ sudo unshare -n bash # Create a shell in a new namespace
> # ip link set lo up
> # ip addr add 127.0.0.1 dev lo
> # ip l2tp add tunnel remote 127.0.0.1 local 127.0.0.1 tunnel_id 1 \
> peer_tunnel_id 1 udp_sport 50000 udp_dport 50000
> # ip l2tp add session name foo tunnel_id 1 session_id 1 \
> peer_session_id 1
> # ip link set foo up
> # exit # Exit the shell, in turn exiting the namespace
> $ dmesg
> ...
> [942121.089216] BUG: scheduling while atomic: kworker/u16:3/13872/0x00000200
> ...
>
> To fix this, move the call to l2tp_tunnel_closeall() out of the RCU
> critical section, and instead call it from l2tp_tunnel_del_work(), which
> is running from the l2tp_wq workqueue.
>
> Fixes: 2b551c6e7d5b ("l2tp: close sessions before initiating tunnel delete")
> Signed-off-by: Ridge Kennedy <[email protected]>
Applied and queued up for -stable, thanks.
