• Eric Dumazet's avatar
    net: annotate lockless accesses to sk->sk_napi_id · ee8d153d
    Eric Dumazet authored
    We already annotated most accesses to sk->sk_napi_id
    
    We missed sk_mark_napi_id() and sk_mark_napi_id_once()
    which might be called without socket lock held in UDP stack.
    
    KCSAN reported :
    BUG: KCSAN: data-race in udpv6_queue_rcv_one_skb / udpv6_queue_rcv_one_skb
    
    write to 0xffff888121c6d108 of 4 bytes by interrupt on cpu 0:
     sk_mark_napi_id include/net/busy_poll.h:125 [inline]
     __udpv6_queue_rcv_skb net/ipv6/udp.c:571 [inline]
     udpv6_queue_rcv_one_skb+0x70c/0xb40 net/ipv6/udp.c:672
     udpv6_queue_rcv_skb+0xb5/0x400 net/ipv6/udp.c:689
     udp6_unicast_rcv_skb.isra.0+0xd7/0x180 net/ipv6/udp.c:832
     __udp6_lib_rcv+0x69c/0x1770 net/ipv6/udp.c:913
     udpv6_rcv+0x2b/0x40 net/ipv6/udp.c:1015
     ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409
     ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450
     NF_HOOK include/linux/netfilter.h:305 [inline]
     NF_HOOK include/linux/netfilter.h:299 [inline]
     ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459
     dst_input include/net/dst.h:442 [inline]
     ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76
     NF_HOOK include/linux/netfilter.h:305 [inline]
     NF_HOOK include/linux/netfilter.h:299 [inline]
     ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284
     __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010
     __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124
     process_backlog+0x1d3/0x420 net/core/dev.c:5955
     napi_poll net/core/dev.c:6392 [inline]
     net_rx_action+0x3ae/0xa90 net/core/dev.c:6460
    
    write to 0xffff888121c6d108 of 4 bytes by interrupt on cpu 1:
     sk_mark_napi_id include/net/busy_poll.h:125 [inline]
     __udpv6_queue_rcv_skb net/ipv6/udp.c:571 [inline]
     udpv6_queue_rcv_one_skb+0x70c/0xb40 net/ipv6/udp.c:672
     udpv6_queue_rcv_skb+0xb5/0x400 net/ipv6/udp.c:689
     udp6_unicast_rcv_skb.isra.0+0xd7/0x180 net/ipv6/udp.c:832
     __udp6_lib_rcv+0x69c/0x1770 net/ipv6/udp.c:913
     udpv6_rcv+0x2b/0x40 net/ipv6/udp.c:1015
     ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409
     ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450
     NF_HOOK include/linux/netfilter.h:305 [inline]
     NF_HOOK include/linux/netfilter.h:299 [inline]
     ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459
     dst_input include/net/dst.h:442 [inline]
     ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76
     NF_HOOK include/linux/netfilter.h:305 [inline]
     NF_HOOK include/linux/netfilter.h:299 [inline]
     ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284
     __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010
     __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124
     process_backlog+0x1d3/0x420 net/core/dev.c:5955
    
    Reported by Kernel Concurrency Sanitizer on:
    CPU: 1 PID: 10890 Comm: syz-executor.0 Not tainted 5.4.0-rc3+ #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    
    Fixes: e68b6e50 ("udp: enable busy polling for all sockets")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ee8d153d
busy_poll.h 3.21 KB