Received: by 2002:a05:6a10:7420:0:0:0:0 with SMTP id hk32csp3969298pxb; Mon, 21 Feb 2022 09:16:46 -0800 (PST) X-Google-Smtp-Source: ABdhPJxFFB6zizSKbqoEIi/9WjEJRS3HTV425sMIoQ4iPd4q48moG4pKRaKMO5Tj9ZKflIdEiUUl X-Received: by 2002:a05:6a00:23c6:b0:4cf:1e1e:ff4f with SMTP id g6-20020a056a0023c600b004cf1e1eff4fmr20634506pfc.80.1645463805892; Mon, 21 Feb 2022 09:16:45 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1645463805; cv=none; d=google.com; s=arc-20160816; b=dc1sR2csZpO2UiXBEe2PAFb3ge9p72CTyQvfek8fX9yJMj6Eo/E+orIsLISXXuQUO0 IKC8xTb4Tef91wywDoH+koZ3VZjoZvkkNlVNNZ0LSz7p6FyxnUx6feXN61ABEFd+D6HB FZmcYcBLqTDLZ4H04NRWR1sOwNe5cclnmPpuh9aeLGSQYS6AAi8N8jANL0RDgyXtWCzJ Vobp4cWYkcp+CKJt9TaWNdX5//N7e3y+XjcFdcxPs5/QoinTVlLdlV2hE+3OUCJwMunT cy0R2oysCW7Wq0Ifse8Nk2o8x3NMPNMmztD2H4KWDInMsDoswa3dBhTaeXKbB3sNqKTC dUHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=9fcKlsCM1y3O4bGdVGTHsKdne5TDXgYqe+OJAfYkd64=; b=buw3+N81tJ9uVuOq7g83gr1wabM3ikU5E9a4PHJQ8SdNqRsyQ2KzqPRS5i89xqQIwO KfYx/P1GWqrEpN8L66W3s52DAX6hNvubd0RuomuREGCV9TIWGGJj8cC4fEn2U4crF2r9 s6K+nKqG/Kfje8nePZS1mOphB04l9YdNNhhWrYjo5XYwnxPe0alnqR56kCNSn2DwT2Gr yUZFYGwoPUDwKPkZnXw6d14p0yU8iM7k5WdW4TOkCS8D3w4iMjYS9wB3FYPRdTdTGNAu 4Pt+yvdbFu4vKgKhuCqcLxqmjK/ycu2F2c8wlAP9pVTqBebcDF+zgk3M5e0vaNaoknIb Gv4g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=UeAtLCKO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id w11si3231244plq.63.2022.02.21.09.16.30; Mon, 21 Feb 2022 09:16:45 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=UeAtLCKO; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347903AbiBUJJu (ORCPT + 99 others); Mon, 21 Feb 2022 04:09:50 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:39484 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347626AbiBUJF5 (ORCPT ); Mon, 21 Feb 2022 04:05:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E3FA30F47; Mon, 21 Feb 2022 00:59:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1ED1361149; Mon, 21 Feb 2022 08:59:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EDF45C340E9; Mon, 21 Feb 2022 08:59:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1645433961; bh=2JG7Emhz+0dUzjwrpIj6a187Sl4f8rTJtPRyKmI/QcA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UeAtLCKOft6TXcRcFl0PxJH24eLgna1PjujuNd+7Kfi48KQrFZAGXBxbKTiR4y550 iZjtqYKlg/a8K4p8rKYbo4vrq3B2/NpWzwXx5ca/3t/8pJAWuaxODOklavDm2qFO8N azJfkS05WqZPfplP3t2BoInwXiH4gOKmtrLnLkfk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Neil Horman , syzbot , "David S. Miller" Subject: [PATCH 5.4 43/80] drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit Date: Mon, 21 Feb 2022 09:49:23 +0100 Message-Id: <20220221084916.985220638@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220221084915.554151737@linuxfoundation.org> References: <20220221084915.554151737@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Dumazet commit dcd54265c8bc14bd023815e36e2d5f9d66ee1fee upstream. trace_napi_poll_hit() is reading stat->dev while another thread can write on it from dropmon_net_event() Use READ_ONCE()/WRITE_ONCE() here, RCU rules are properly enforced already, we only have to take care of load/store tearing. BUG: KCSAN: data-race in dropmon_net_event / trace_napi_poll_hit write to 0xffff88816f3ab9c0 of 8 bytes by task 20260 on cpu 1: dropmon_net_event+0xb8/0x2b0 net/core/drop_monitor.c:1579 notifier_call_chain kernel/notifier.c:84 [inline] raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:392 call_netdevice_notifiers_info net/core/dev.c:1919 [inline] call_netdevice_notifiers_extack net/core/dev.c:1931 [inline] call_netdevice_notifiers net/core/dev.c:1945 [inline] unregister_netdevice_many+0x867/0xfb0 net/core/dev.c:10415 ip_tunnel_delete_nets+0x24a/0x280 net/ipv4/ip_tunnel.c:1123 vti_exit_batch_net+0x2a/0x30 net/ipv4/ip_vti.c:515 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x4dc/0x8d0 net/core/net_namespace.c:597 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 read to 0xffff88816f3ab9c0 of 8 bytes by interrupt on cpu 0: trace_napi_poll_hit+0x89/0x1c0 net/core/drop_monitor.c:292 trace_napi_poll include/trace/events/napi.h:14 [inline] __napi_poll+0x36b/0x3f0 net/core/dev.c:6366 napi_poll net/core/dev.c:6432 [inline] net_rx_action+0x29e/0x650 net/core/dev.c:6519 __do_softirq+0x158/0x2de kernel/softirq.c:558 do_softirq+0xb1/0xf0 kernel/softirq.c:459 __local_bh_enable_ip+0x68/0x70 kernel/softirq.c:383 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x33/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:394 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x73c/0x780 drivers/net/wireguard/receive.c:506 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 value changed: 0xffff88815883e000 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 26435 Comm: kworker/0:1 Not tainted 5.17.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker Fixes: 4ea7e38696c7 ("dropmon: add ability to detect when hardware dropsrxpackets") Signed-off-by: Eric Dumazet Cc: Neil Horman Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/drop_monitor.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/net/core/drop_monitor.c +++ b/net/core/drop_monitor.c @@ -277,13 +277,17 @@ static void trace_napi_poll_hit(void *ig rcu_read_lock(); list_for_each_entry_rcu(new_stat, &hw_stats_list, list) { + struct net_device *dev; + /* * only add a note to our monitor buffer if: * 1) this is the dev we received on * 2) its after the last_rx delta * 3) our rx_dropped count has gone up */ - if ((new_stat->dev == napi->dev) && + /* Paired with WRITE_ONCE() in dropmon_net_event() */ + dev = READ_ONCE(new_stat->dev); + if ((dev == napi->dev) && (time_after(jiffies, new_stat->last_rx + dm_hw_check_delta)) && (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) { trace_drop_common(NULL, NULL); @@ -1497,7 +1501,10 @@ static int dropmon_net_event(struct noti mutex_lock(&net_dm_mutex); list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) { if (new_stat->dev == dev) { - new_stat->dev = NULL; + + /* Paired with READ_ONCE() in trace_napi_poll_hit() */ + WRITE_ONCE(new_stat->dev, NULL); + if (trace_state == TRACE_OFF) { list_del_rcu(&new_stat->list); kfree_rcu(new_stat, rcu);