forked from luck/tmp_suning_uos_patched
net_sched: add __rcu annotation to netdev->qdisc
commit 5891cd5ec46c2c2eb6427cb54d214b149635dd0e upstream.
syzbot found a data-race [1] which lead me to add __rcu
annotations to netdev->qdisc, and proper accessors
to get LOCKDEP support.
[1]
BUG: KCSAN: data-race in dev_activate / qdisc_lookup_rcu
write to 0xffff888168ad6410 of 8 bytes by task 13559 on cpu 1:
attach_default_qdiscs net/sched/sch_generic.c:1167 [inline]
dev_activate+0x2ed/0x8f0 net/sched/sch_generic.c:1221
__dev_open+0x2e9/0x3a0 net/core/dev.c:1416
__dev_change_flags+0x167/0x3f0 net/core/dev.c:8139
rtnl_configure_link+0xc2/0x150 net/core/rtnetlink.c:3150
__rtnl_newlink net/core/rtnetlink.c:3489 [inline]
rtnl_newlink+0xf4d/0x13e0 net/core/rtnetlink.c:3529
rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg net/socket.c:725 [inline]
____sys_sendmsg+0x39a/0x510 net/socket.c:2413
___sys_sendmsg net/socket.c:2467 [inline]
__sys_sendmsg+0x195/0x230 net/socket.c:2496
__do_sys_sendmsg net/socket.c:2505 [inline]
__se_sys_sendmsg net/socket.c:2503 [inline]
__x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888168ad6410 of 8 bytes by task 13560 on cpu 0:
qdisc_lookup_rcu+0x30/0x2e0 net/sched/sch_api.c:323
__tcf_qdisc_find+0x74/0x3a0 net/sched/cls_api.c:1050
tc_del_tfilter+0x1c7/0x1350 net/sched/cls_api.c:2211
rtnetlink_rcv_msg+0x5ba/0x7e0 net/core/rtnetlink.c:5585
netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg net/socket.c:725 [inline]
____sys_sendmsg+0x39a/0x510 net/socket.c:2413
___sys_sendmsg net/socket.c:2467 [inline]
__sys_sendmsg+0x195/0x230 net/socket.c:2496
__do_sys_sendmsg net/socket.c:2505 [inline]
__se_sys_sendmsg net/socket.c:2503 [inline]
__x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0xffffffff85dee080 -> 0xffff88815d96ec00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13560 Comm: syz-executor.2 Not tainted 5.17.0-rc3-syzkaller-00116-gf1baf68e1383-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Fixes: 470502de5b ("net: sched: unlock rules update API")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vlad Buslov <vladbu@mellanox.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eric Dumazet
Greg Kroah-Hartman
parent
877a05672f
commit
d9bd9d4c60
|
|
@ -2061,7 +2061,7 @@ struct net_device {
|
|||
struct netdev_queue *_tx ____cacheline_aligned_in_smp;
|
||||
unsigned int num_tx_queues;
|
||||
unsigned int real_num_tx_queues;
|
||||
struct Qdisc *qdisc;
|
||||
struct Qdisc __rcu *qdisc;
|
||||
unsigned int tx_queue_len;
|
||||
spinlock_t tx_global_lock;
|
||||
|
||||
|
|
|
|||
|
|
@ -1705,6 +1705,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
|
|||
{
|
||||
struct ifinfomsg *ifm;
|
||||
struct nlmsghdr *nlh;
|
||||
struct Qdisc *qdisc;
|
||||
|
||||
ASSERT_RTNL();
|
||||
nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ifm), flags);
|
||||
|
|
@ -1722,6 +1723,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
|
|||
if (tgt_netnsid >= 0 && nla_put_s32(skb, IFLA_TARGET_NETNSID, tgt_netnsid))
|
||||
goto nla_put_failure;
|
||||
|
||||
qdisc = rtnl_dereference(dev->qdisc);
|
||||
if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
|
||||
nla_put_u32(skb, IFLA_TXQLEN, dev->tx_queue_len) ||
|
||||
nla_put_u8(skb, IFLA_OPERSTATE,
|
||||
|
|
@ -1740,8 +1742,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
|
|||
#endif
|
||||
put_master_ifindex(skb, dev) ||
|
||||
nla_put_u8(skb, IFLA_CARRIER, netif_carrier_ok(dev)) ||
|
||||
(dev->qdisc &&
|
||||
nla_put_string(skb, IFLA_QDISC, dev->qdisc->ops->id)) ||
|
||||
(qdisc &&
|
||||
nla_put_string(skb, IFLA_QDISC, qdisc->ops->id)) ||
|
||||
nla_put_ifalias(skb, dev) ||
|
||||
nla_put_u32(skb, IFLA_CARRIER_CHANGES,
|
||||
atomic_read(&dev->carrier_up_count) +
|
||||
|
|
|
|||
|
|
@ -1045,7 +1045,7 @@ static int __tcf_qdisc_find(struct net *net, struct Qdisc **q,
|
|||
|
||||
/* Find qdisc */
|
||||
if (!*parent) {
|
||||
*q = dev->qdisc;
|
||||
*q = rcu_dereference(dev->qdisc);
|
||||
*parent = (*q)->handle;
|
||||
} else {
|
||||
*q = qdisc_lookup_rcu(dev, TC_H_MAJ(*parent));
|
||||
|
|
@ -2591,7 +2591,7 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
|
|||
|
||||
parent = tcm->tcm_parent;
|
||||
if (!parent)
|
||||
q = dev->qdisc;
|
||||
q = rtnl_dereference(dev->qdisc);
|
||||
else
|
||||
q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
|
||||
if (!q)
|
||||
|
|
@ -2977,7 +2977,7 @@ static int tc_dump_chain(struct sk_buff *skb, struct netlink_callback *cb)
|
|||
|
||||
parent = tcm->tcm_parent;
|
||||
if (!parent) {
|
||||
q = dev->qdisc;
|
||||
q = rtnl_dereference(dev->qdisc);
|
||||
parent = q->handle;
|
||||
} else {
|
||||
q = qdisc_lookup(dev, TC_H_MAJ(tcm->tcm_parent));
|
||||
|
|
|
|||
|
|
@ -301,7 +301,7 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
|
|||
|
||||
if (!handle)
|
||||
return NULL;
|
||||
q = qdisc_match_from_root(dev->qdisc, handle);
|
||||
q = qdisc_match_from_root(rtnl_dereference(dev->qdisc), handle);
|
||||
if (q)
|
||||
goto out;
|
||||
|
||||
|
|
@ -320,7 +320,7 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
|
|||
|
||||
if (!handle)
|
||||
return NULL;
|
||||
q = qdisc_match_from_root(dev->qdisc, handle);
|
||||
q = qdisc_match_from_root(rcu_dereference(dev->qdisc), handle);
|
||||
if (q)
|
||||
goto out;
|
||||
|
||||
|
|
@ -1082,10 +1082,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
|
|||
skip:
|
||||
if (!ingress) {
|
||||
notify_and_destroy(net, skb, n, classid,
|
||||
dev->qdisc, new);
|
||||
rtnl_dereference(dev->qdisc), new);
|
||||
if (new && !new->ops->attach)
|
||||
qdisc_refcount_inc(new);
|
||||
dev->qdisc = new ? : &noop_qdisc;
|
||||
rcu_assign_pointer(dev->qdisc, new ? : &noop_qdisc);
|
||||
|
||||
if (new && new->ops->attach)
|
||||
new->ops->attach(new);
|
||||
|
|
@ -1460,7 +1460,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
|||
q = dev_ingress_queue(dev)->qdisc_sleeping;
|
||||
}
|
||||
} else {
|
||||
q = dev->qdisc;
|
||||
q = rtnl_dereference(dev->qdisc);
|
||||
}
|
||||
if (!q) {
|
||||
NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
|
||||
|
|
@ -1549,7 +1549,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
|||
q = dev_ingress_queue(dev)->qdisc_sleeping;
|
||||
}
|
||||
} else {
|
||||
q = dev->qdisc;
|
||||
q = rtnl_dereference(dev->qdisc);
|
||||
}
|
||||
|
||||
/* It may be default qdisc, ignore it */
|
||||
|
|
@ -1771,7 +1771,8 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
|
|||
s_q_idx = 0;
|
||||
q_idx = 0;
|
||||
|
||||
if (tc_dump_qdisc_root(dev->qdisc, skb, cb, &q_idx, s_q_idx,
|
||||
if (tc_dump_qdisc_root(rtnl_dereference(dev->qdisc),
|
||||
skb, cb, &q_idx, s_q_idx,
|
||||
true, tca[TCA_DUMP_INVISIBLE]) < 0)
|
||||
goto done;
|
||||
|
||||
|
|
@ -2047,7 +2048,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
|
|||
} else if (qid1) {
|
||||
qid = qid1;
|
||||
} else if (qid == 0)
|
||||
qid = dev->qdisc->handle;
|
||||
qid = rtnl_dereference(dev->qdisc)->handle;
|
||||
|
||||
/* Now qid is genuine qdisc handle consistent
|
||||
* both with parent and child.
|
||||
|
|
@ -2058,7 +2059,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
|
|||
portid = TC_H_MAKE(qid, portid);
|
||||
} else {
|
||||
if (qid == 0)
|
||||
qid = dev->qdisc->handle;
|
||||
qid = rtnl_dereference(dev->qdisc)->handle;
|
||||
}
|
||||
|
||||
/* OK. Locate qdisc */
|
||||
|
|
@ -2219,7 +2220,8 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
|
|||
s_t = cb->args[0];
|
||||
t = 0;
|
||||
|
||||
if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0)
|
||||
if (tc_dump_tclass_root(rtnl_dereference(dev->qdisc),
|
||||
skb, tcm, cb, &t, s_t, true) < 0)
|
||||
goto done;
|
||||
|
||||
dev_queue = dev_ingress_queue(dev);
|
||||
|
|
|
|||
|
|
@ -1088,30 +1088,33 @@ static void attach_default_qdiscs(struct net_device *dev)
|
|||
if (!netif_is_multiqueue(dev) ||
|
||||
dev->priv_flags & IFF_NO_QUEUE) {
|
||||
netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
|
||||
dev->qdisc = txq->qdisc_sleeping;
|
||||
qdisc_refcount_inc(dev->qdisc);
|
||||
qdisc = txq->qdisc_sleeping;
|
||||
rcu_assign_pointer(dev->qdisc, qdisc);
|
||||
qdisc_refcount_inc(qdisc);
|
||||
} else {
|
||||
qdisc = qdisc_create_dflt(txq, &mq_qdisc_ops, TC_H_ROOT, NULL);
|
||||
if (qdisc) {
|
||||
dev->qdisc = qdisc;
|
||||
rcu_assign_pointer(dev->qdisc, qdisc);
|
||||
qdisc->ops->attach(qdisc);
|
||||
}
|
||||
}
|
||||
qdisc = rtnl_dereference(dev->qdisc);
|
||||
|
||||
/* Detect default qdisc setup/init failed and fallback to "noqueue" */
|
||||
if (dev->qdisc == &noop_qdisc) {
|
||||
if (qdisc == &noop_qdisc) {
|
||||
netdev_warn(dev, "default qdisc (%s) fail, fallback to %s\n",
|
||||
default_qdisc_ops->id, noqueue_qdisc_ops.id);
|
||||
dev->priv_flags |= IFF_NO_QUEUE;
|
||||
netdev_for_each_tx_queue(dev, attach_one_default_qdisc, NULL);
|
||||
dev->qdisc = txq->qdisc_sleeping;
|
||||
qdisc_refcount_inc(dev->qdisc);
|
||||
qdisc = txq->qdisc_sleeping;
|
||||
rcu_assign_pointer(dev->qdisc, qdisc);
|
||||
qdisc_refcount_inc(qdisc);
|
||||
dev->priv_flags ^= IFF_NO_QUEUE;
|
||||
}
|
||||
|
||||
#ifdef CONFIG_NET_SCHED
|
||||
if (dev->qdisc != &noop_qdisc)
|
||||
qdisc_hash_add(dev->qdisc, false);
|
||||
if (qdisc != &noop_qdisc)
|
||||
qdisc_hash_add(qdisc, false);
|
||||
#endif
|
||||
}
|
||||
|
||||
|
|
@ -1141,7 +1144,7 @@ void dev_activate(struct net_device *dev)
|
|||
* and noqueue_qdisc for virtual interfaces
|
||||
*/
|
||||
|
||||
if (dev->qdisc == &noop_qdisc)
|
||||
if (rtnl_dereference(dev->qdisc) == &noop_qdisc)
|
||||
attach_default_qdiscs(dev);
|
||||
|
||||
if (!netif_carrier_ok(dev))
|
||||
|
|
@ -1306,7 +1309,7 @@ static int qdisc_change_tx_queue_len(struct net_device *dev,
|
|||
void dev_qdisc_change_real_num_tx(struct net_device *dev,
|
||||
unsigned int new_real_tx)
|
||||
{
|
||||
struct Qdisc *qdisc = dev->qdisc;
|
||||
struct Qdisc *qdisc = rtnl_dereference(dev->qdisc);
|
||||
|
||||
if (qdisc->ops->change_real_num_tx)
|
||||
qdisc->ops->change_real_num_tx(qdisc, new_real_tx);
|
||||
|
|
@ -1346,7 +1349,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,
|
|||
|
||||
void dev_init_scheduler(struct net_device *dev)
|
||||
{
|
||||
dev->qdisc = &noop_qdisc;
|
||||
rcu_assign_pointer(dev->qdisc, &noop_qdisc);
|
||||
netdev_for_each_tx_queue(dev, dev_init_scheduler_queue, &noop_qdisc);
|
||||
if (dev_ingress_queue(dev))
|
||||
dev_init_scheduler_queue(dev, dev_ingress_queue(dev), &noop_qdisc);
|
||||
|
|
@ -1374,8 +1377,8 @@ void dev_shutdown(struct net_device *dev)
|
|||
netdev_for_each_tx_queue(dev, shutdown_scheduler_queue, &noop_qdisc);
|
||||
if (dev_ingress_queue(dev))
|
||||
shutdown_scheduler_queue(dev, dev_ingress_queue(dev), &noop_qdisc);
|
||||
qdisc_put(dev->qdisc);
|
||||
dev->qdisc = &noop_qdisc;
|
||||
qdisc_put(rtnl_dereference(dev->qdisc));
|
||||
rcu_assign_pointer(dev->qdisc, &noop_qdisc);
|
||||
|
||||
WARN_ON(timer_pending(&dev->watchdog_timer));
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user