• Eric Dumazet's avatar
    net_sched: add __rcu annotation to netdev->qdisc · 5891cd5e
    Eric Dumazet authored
    syzbot found a data-race [1] which lead me to add __rcu
    annotations to netdev->qdisc, and proper accessors
    to get LOCKDEP support.
    
    [1]
    BUG: KCSAN: data-race in dev_activate / qdisc_lookup_rcu
    
    write to 0xffff888168ad6410 of 8 bytes by task 13559 on cpu 1:
     attach_default_qdiscs net/sched/sch_generic.c:1167 [inline]
     dev_activate+0x2ed/0x8f0 net/sched/sch_generic.c:1221
     __dev_open+0x2e9/0x3a0 net/core/dev.c:1416
     __dev_change_flags+0x167/0x3f0 net/core/dev.c:8139
     rtnl_configure_link+0xc2/0x150 net/core/rtnetlink.c:3150
     __rtnl_newlink net/core/rtnetlink.c:3489 [inline]
     rtnl_newlink+0xf4d/0x13e0 net/core/rtnetlink.c:3529
     rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594
     netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
     rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
     netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
     netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
     netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
     sock_sendmsg_nosec net/socket.c:705 [inline]
     sock_sendmsg net/socket.c:725 [inline]
     ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
     ___sys_sendmsg net/socket.c:2467 [inline]
     __sys_sendmsg+0x195/0x230 net/socket.c:2496
     __do_sys_sendmsg net/socket.c:2505 [inline]
     __se_sys_sendmsg net/socket.c:2503 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff888168ad6410 of 8 bytes by task 13560 on cpu 0:
     qdisc_lookup_rcu+0x30/0x2e0 net/sched/sch_api.c:323
     __tcf_qdisc_find+0x74/0x3a0 net/sched/cls_api.c:1050
     tc_del_tfilter+0x1c7/0x1350 net/sched/cls_api.c:2211
     rtnetlink_rcv_msg+0x5ba/0x7e0 net/core/rtnetlink.c:5585
     netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494
     rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612
     netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
     netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343
     netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919
     sock_sendmsg_nosec net/socket.c:705 [inline]
     sock_sendmsg net/socket.c:725 [inline]
     ____sys_sendmsg+0x39a/0x510 net/socket.c:2413
     ___sys_sendmsg net/socket.c:2467 [inline]
     __sys_sendmsg+0x195/0x230 net/socket.c:2496
     __do_sys_sendmsg net/socket.c:2505 [inline]
     __se_sys_sendmsg net/socket.c:2503 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    value changed: 0xffffffff85dee080 -> 0xffff88815d96ec00
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 13560 Comm: syz-executor.2 Not tainted 5.17.0-rc3-syzkaller-00116-gf1baf68e-dirty #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: 470502de ("net: sched: unlock rules update API")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: Vlad Buslov <vladbu@mellanox.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5891cd5e
sch_api.c 54.7 KB