• Ido Schimmel's avatar
    ipmr: Always call ip{,6}_mr_forward() from RCU read-side critical section · b07a9b26
    Ido Schimmel authored
    These functions expect to be called from RCU read-side critical section,
    but this only happens when invoked from the data path via
    ip{,6}_mr_input(). They can also be invoked from process context in
    response to user space adding a multicast route which resolves a cache
    entry with queued packets [1][2].
    
    Fix by adding missing rcu_read_lock() / rcu_read_unlock() in these call
    paths.
    
    [1]
    WARNING: suspicious RCU usage
    6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Not tainted
    -----------------------------
    net/ipv4/ipmr.c:84 suspicious rcu_dereference_check() usage!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    1 lock held by smcrouted/246:
     #0: ffffffff862389b0 (rtnl_mutex){+.+.}-{3:3}, at: ip_mroute_setsockopt+0x11c/0x1420
    
    stack backtrace:
    CPU: 0 PID: 246 Comm: smcrouted Not tainted 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x91/0xb9
     vif_dev_read+0xbf/0xd0
     ipmr_queue_xmit+0x135/0x1ab0
     ip_mr_forward+0xe7b/0x13d0
     ipmr_mfc_add+0x1a06/0x2ad0
     ip_mroute_setsockopt+0x5c1/0x1420
     do_ip_setsockopt+0x23d/0x37f0
     ip_setsockopt+0x56/0x80
     raw_setsockopt+0x219/0x290
     __sys_setsockopt+0x236/0x4d0
     __x64_sys_setsockopt+0xbe/0x160
     do_syscall_64+0x34/0x80
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    [2]
    WARNING: suspicious RCU usage
    6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387 Not tainted
    -----------------------------
    net/ipv6/ip6mr.c:69 suspicious rcu_dereference_check() usage!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    1 lock held by smcrouted/246:
     #0: ffffffff862389b0 (rtnl_mutex){+.+.}-{3:3}, at: ip6_mroute_setsockopt+0x6b9/0x2630
    
    stack backtrace:
    CPU: 1 PID: 246 Comm: smcrouted Not tainted 6.0.0-rc3-custom-15969-g049d233c8bcc-dirty #1387
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x91/0xb9
     vif_dev_read+0xbf/0xd0
     ip6mr_forward2.isra.0+0xc9/0x1160
     ip6_mr_forward+0xef0/0x13f0
     ip6mr_mfc_add+0x1ff2/0x31f0
     ip6_mroute_setsockopt+0x1825/0x2630
     do_ipv6_setsockopt+0x462/0x4440
     ipv6_setsockopt+0x105/0x140
     rawv6_setsockopt+0xd8/0x690
     __sys_setsockopt+0x236/0x4d0
     __x64_sys_setsockopt+0xbe/0x160
     do_syscall_64+0x34/0x80
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Fixes: ebc31979 ("ipmr: add rcu protection over (struct vif_device)->dev")
    Signed-off-by: default avatarIdo Schimmel <idosch@nvidia.com>
    Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    b07a9b26
ipmr.c 76.8 KB