Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp672309img; Fri, 22 Mar 2019 06:19:06 -0700 (PDT) X-Google-Smtp-Source: APXvYqx7z95nqQuLppumh5q/vvVfb3r6FUrgk3Wbg3MQk2gIPO4aD2vuqU3kP4BKzDX3Z5bhMbGM X-Received: by 2002:a63:5c66:: with SMTP id n38mr8861898pgm.15.1553260746082; Fri, 22 Mar 2019 06:19:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553260746; cv=none; d=google.com; s=arc-20160816; b=OGsK+GN07kvlmcuHP5Tssd+haskJYVABJ2SCZdRxr0J9ZhuUDWnfUb+B/ZQNnuEEWk razZTjgOBsiti7D4Bh12vI8UN4iU8eHEUrc+X0MxQ5m6DYJgQQJfqJkRxesBXwrfXPS8 pI+QP96rgEEqKhXz1opoEik4ihW46K/TKKHJY3zVNYBBSEON81idoLV48abz3TdGGklT N6GRTbafkbyLT/SNPr4ZFDjvp5st5hTYmWjYzHKQiKwtlxRL2veEXqOeUX8DsJW82pz4 pyZnkpgIeuCcIVCMvm8AeJS5JsXAkOXluEvQwBrVerAv8B57Tjfuz539kvma+3zXow2D YUgg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=eEZn+ppAZh9qZ3MfSRw6oc9W/1dU9mXb60PyfbtxS50=; b=nulRlnnbg2bIOm8HVYnyN/VWxyq3v04gvvJH7HNwGGaIiIFLJWBQvqgeNV5v2eGBn/ 9DTq8rMlswpqfG07spSgskOuK1CImxwuWJ2zU+9kGI2vq2Zdn61O/NtGEcmKDwUra06A CErXcGQhgBQqcFw5aUrTpAbH1qv57+Tt/EzU0RgUAF4Z7/rCvnV/CZqATexcdi7Cdp0j tNntbcBD+EXMXnDf+tz4wjMelgV8hAXFkDxQi3PpsYezDcwsElWuI8abjS7/KMggjU+i OoNO17aE+8SVDjnllD32cRGRA73F3Y9dayG6qcsNpuJkIiq5SykP4lJn7HAkRvLc1s00 F5+A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=TVIk1dSv; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x15si6654477pgi.420.2019.03.22.06.18.47; Fri, 22 Mar 2019 06:19:06 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=TVIk1dSv; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729090AbfCVLYR (ORCPT + 99 others); Fri, 22 Mar 2019 07:24:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:51318 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728731AbfCVLYQ (ORCPT ); Fri, 22 Mar 2019 07:24:16 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9D61F218A2; Fri, 22 Mar 2019 11:24:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553253855; bh=7qn1BgPArp80FkyveB1hRhDQZK+dVzQGaU9AJO0H6uQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TVIk1dSvJ6UtDKXBk/lJ7tz76uaNZCLkqDRGyol9R9tsp5+qiPKkzUbh8B7xlPjHb X+yw7wlxvVfSe6kT2cE5N7uLkoYKK0GNZN7jBj7pxfFLKDPsPFmIJ5Bn5dszAWEKvr kOALyu8yLjYzHjSka228oGefy3iuQBr2X9pX3xDw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 3.18 092/134] gro_cells: make sure device is up in gro_cells_receive() Date: Fri, 22 Mar 2019 12:15:05 +0100 Message-Id: <20190322111216.809328937@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190322111210.465931067@linuxfoundation.org> References: <20190322111210.465931067@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 2a5ff07a0eb945f291e361aa6f6becca8340ba46 ] We keep receiving syzbot reports [1] that show that tunnels do not play the rcu/IFF_UP rules properly. At device dismantle phase, gro_cells_destroy() will be called only after a full rcu grace period is observed after IFF_UP has been cleared. This means that IFF_UP needs to be tested before queueing packets into netif_rx() or gro_cells. This patch implements the test in gro_cells_receive() because too many callers do not seem to bother enough. [1] BUG: unable to handle kernel paging request at fffff4ca0b9ffffe PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 kobject: 'loop2' (000000004bd7d84a): kobject_uevent_env FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0 Call Trace: kobject: 'loop2' (000000004bd7d84a): fill_kobj_path: path = '/devices/virtual/block/loop2' ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1010 netdev_run_todo+0x51c/0x7d0 net/core/dev.c:8970 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:116 ip_tunnel_delete_nets+0x423/0x5f0 net/ipv4/ip_tunnel.c:1124 vti_exit_batch_net+0x23/0x30 net/ipv4/ip_vti.c:495 ops_exit_list.isra.0+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x3fb/0x960 net/core/net_namespace.c:551 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173 worker_thread+0x98/0xe40 kernel/workqueue.c:2319 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: CR2: fffff4ca0b9ffffe [ end trace 513fc9c1338d1cb3 ] RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 kobject: 'loop3' (00000000e4ee57a6): kobject_uevent_env R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0 Fixes: c9e6bc644e55 ("net: add gro_cells infrastructure") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/gro_cells.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/include/net/gro_cells.h +++ b/include/net/gro_cells.h @@ -20,18 +20,23 @@ static inline void gro_cells_receive(str struct gro_cell *cell = gcells->cells; struct net_device *dev = skb->dev; + rcu_read_lock(); + if (unlikely(!(dev->flags & IFF_UP))) + goto drop; + if (!cell || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) { netif_rx(skb); - return; + goto unlock; } if (skb_rx_queue_recorded(skb)) cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask; if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) { +drop: atomic_long_inc(&dev->rx_dropped); kfree_skb(skb); - return; + goto unlock; } /* We run in BH context */ @@ -42,6 +47,9 @@ static inline void gro_cells_receive(str napi_schedule(&cell->napi); spin_unlock(&cell->napi_skbs.lock); + +unlock: + rcu_read_unlock(); } /* called unser BH context */