Eric Dumazet ffa8df4f0e bonding: fix data-races around agg_select_timer ... commit 9ceaf6f76b203682bb6100e14b3d7da4c0bedde8 upstream. syzbot reported that two threads might write over agg_select_timer at the same time. Make agg_select_timer atomic to fix the races. BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1: bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0: bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998 bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967 __dev_open+0x274/0x3a0 net/core/dev.c:1407 dev_open+0x54/0x190 net/core/dev.c:1443 bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937 do_set_master net/core/rtnetlink.c:2532 [inline] do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736 __rtnl_newlink net/core/rtnetlink.c:3414 [inline] rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529 rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmsg+0x195/0x230 net/socket.c:2496 __do_sys_sendmsg net/socket.c:2505 [inline] __se_sys_sendmsg net/socket.c:2503 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000050 -> 0x0000004f Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G W 5.17.0-rc4-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: Jay Vosburgh <j.vosburgh@gmail.com> Cc: Veaceslav Falico <vfalico@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-23 12:01:02 +01:00
..
acpi	ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions	2022-01-27 10:54:18 +01:00
asm-generic	vmlinux.lds.h: Handle clang's module.{c,d}tor sections	2021-08-18 08:59:18 +02:00
clocksource	clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG	2021-07-14 16:56:12 +02:00
crypto	crypto: public_key: fix overflow during implicit conversion	2021-09-18 13:40:08 +02:00
drm	drm: protect drm_master pointers in drm_lease.c	2021-09-18 13:40:19 +02:00
dt-bindings	clk: imx8mq: remove SYS PLL 1/2 clock gates	2021-07-14 16:56:20 +02:00
keys	certs: Add EFI_CERT_X509_GUID support for dbx entries	2021-06-30 08:47:30 -04:00
kunit
kvm
linux	net_sched: add __rcu annotation to netdev->qdisc	2022-02-23 12:01:02 +01:00
math-emu
media	media: subdev: disallow ioctl for saa6588/davinci	2021-07-19 09:45:02 +02:00
memory	memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode	2021-11-18 14:03:47 +01:00
misc
net	bonding: fix data-races around agg_select_timer	2022-02-23 12:01:02 +01:00
pcmcia
ras
rdma	RDMA/netlink: Add __maybe_unused to static inline in C file	2021-11-26 10:39:21 +01:00
scsi	scsi: iscsi: Fix conn use after free during resets	2021-07-20 16:05:41 +02:00
soc	firmware: raspberrypi: Keep count of all consumers	2021-09-15 09:50:41 +02:00
sound	ALSA: hda: hdac_ext_stream: fix potential locking issues	2021-11-26 10:39:22 +01:00
target	scsi: target: Fix ordered tag handling	2021-11-26 10:39:11 +01:00
trace	cgroup: Trace event cgroup id fields should be u64	2022-01-27 10:53:52 +01:00
uapi	can: isotp: add SF_BROADCAST support for functional addressing	2022-02-23 12:00:56 +01:00
vdso
video
xen	xen: sync include/xen/interface/io/ring.h with Xen's newest version	2021-12-01 09:19:09 +01:00