• Eric Dumazet's avatar
    ipv4: fix data races in fib_alias_hw_flags_set · 9fcf986c
    Eric Dumazet authored
    fib_alias_hw_flags_set() can be used by concurrent threads,
    and is only RCU protected.
    
    We need to annotate accesses to following fields of struct fib_alias:
    
        offload, trap, offload_failed
    
    Because of READ_ONCE()WRITE_ONCE() limitations, make these
    field u8.
    
    BUG: KCSAN: data-race in fib_alias_hw_flags_set / fib_alias_hw_flags_set
    
    read to 0xffff888134224a6a of 1 bytes by task 2013 on cpu 1:
     fib_alias_hw_flags_set+0x28a/0x470 net/ipv4/fib_trie.c:1050
     nsim_fib4_rt_hw_flags_set drivers/net/netdevsim/fib.c:350 [inline]
     nsim_fib4_rt_add drivers/net/netdevsim/fib.c:367 [inline]
     nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:429 [inline]
     nsim_fib4_event drivers/net/netdevsim/fib.c:461 [inline]
     nsim_fib_event drivers/net/netdevsim/fib.c:881 [inline]
     nsim_fib_event_work+0x1852/0x2cf0 drivers/net/netdevsim/fib.c:1477
     process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
     process_scheduled_works kernel/workqueue.c:2370 [inline]
     worker_thread+0x7df/0xa70 kernel/workqueue.c:2456
     kthread+0x1bf/0x1e0 kernel/kthread.c:377
     ret_from_fork+0x1f/0x30
    
    write to 0xffff888134224a6a of 1 bytes by task 4872 on cpu 0:
     fib_alias_hw_flags_set+0x2d5/0x470 net/ipv4/fib_trie.c:1054
     nsim_fib4_rt_hw_flags_set drivers/net/netdevsim/fib.c:350 [inline]
     nsim_fib4_rt_add drivers/net/netdevsim/fib.c:367 [inline]
     nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:429 [inline]
     nsim_fib4_event drivers/net/netdevsim/fib.c:461 [inline]
     nsim_fib_event drivers/net/netdevsim/fib.c:881 [inline]
     nsim_fib_event_work+0x1852/0x2cf0 drivers/net/netdevsim/fib.c:1477
     process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
     process_scheduled_works kernel/workqueue.c:2370 [inline]
     worker_thread+0x7df/0xa70 kernel/workqueue.c:2456
     kthread+0x1bf/0x1e0 kernel/kthread.c:377
     ret_from_fork+0x1f/0x30
    
    value changed: 0x00 -> 0x02
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 0 PID: 4872 Comm: kworker/0:0 Not tainted 5.17.0-rc3-syzkaller-00188-g1d41d2e8-dirty #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Workqueue: events nsim_fib_event_work
    
    Fixes: 90b93f1b ("ipv4: Add "offload" and "trap" indications to routes")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
    Link: https://lore.kernel.org/r/20220216173217.3792411-1-eric.dumazet@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    9fcf986c
route.c 94.1 KB