• Eric Dumazet's avatar
    bonding: make tx_rebalance_counter an atomic · dac8e00f
    Eric Dumazet authored
    KCSAN reported a data-race [1] around tx_rebalance_counter
    which can be accessed from different contexts, without
    the protection of a lock/mutex.
    
    [1]
    BUG: KCSAN: data-race in bond_alb_init_slave / bond_alb_monitor
    
    write to 0xffff888157e8ca24 of 4 bytes by task 7075 on cpu 0:
     bond_alb_init_slave+0x713/0x860 drivers/net/bonding/bond_alb.c:1613
     bond_enslave+0xd94/0x3010 drivers/net/bonding/bond_main.c:1949
     do_set_master net/core/rtnetlink.c:2521 [inline]
     __rtnl_newlink net/core/rtnetlink.c:3475 [inline]
     rtnl_newlink+0x1298/0x13b0 net/core/rtnetlink.c:3506
     rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5571
     netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2491
     rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5589
     netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
     netlink_unicast+0x5fc/0x6c0 net/netlink/af_netlink.c:1345
     netlink_sendmsg+0x6e1/0x7d0 net/netlink/af_netlink.c:1916
     sock_sendmsg_nosec net/socket.c:704 [inline]
     sock_sendmsg net/socket.c:724 [inline]
     ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
     ___sys_sendmsg net/socket.c:2463 [inline]
     __sys_sendmsg+0x195/0x230 net/socket.c:2492
     __do_sys_sendmsg net/socket.c:2501 [inline]
     __se_sys_sendmsg net/socket.c:2499 [inline]
     __x64_sys_sendmsg+0x42/0x50 net/socket.c:2499
     do_syscall_x64 arch/x86/entry/common.c:50 [inline]
     do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    read to 0xffff888157e8ca24 of 4 bytes by task 1082 on cpu 1:
     bond_alb_monitor+0x8f/0xc00 drivers/net/bonding/bond_alb.c:1511
     process_one_work+0x3fc/0x980 kernel/workqueue.c:2298
     worker_thread+0x616/0xa70 kernel/workqueue.c:2445
     kthread+0x2c7/0x2e0 kernel/kthread.c:327
     ret_from_fork+0x1f/0x30
    
    value changed: 0x00000001 -> 0x00000064
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 1082 Comm: kworker/u4:3 Not tainted 5.16.0-rc3-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Workqueue: bond1 bond_alb_monitor
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    dac8e00f
bond_alb.h 6.09 KB